Package: python3-bandit
Version: 1.7.10-3
Severity: grave
Justification: renders package unusable
X-Debbugs-Cc: [email protected]
Running bandit even on a trivial test case such as this:
#! /usr/bin/env python3
def main() -> int:
print("hello world")
if __name__ == "__main__":
main()
Fails with the following error:
[main] DEBUG logging initialized
[main] INFO profile include tests: None
[main] INFO profile exclude tests: None
[main] INFO cli include tests: None
[main] INFO cli exclude tests: None
[test_set] DEBUG added function
any_other_function_with_shell_equals_true (B604) targeting Call
[test_set] DEBUG added function assert_used (B101) targeting Assert
[test_set] DEBUG added function django_extra_used (B610) targeting Call
[test_set] DEBUG added function django_mark_safe (B703) targeting Call
[test_set] DEBUG added function django_rawsql_used (B611) targeting Call
[test_set] DEBUG added function exec_used (B102) targeting Call
[test_set] DEBUG added function flask_debug_true (B201) targeting Call
[test_set] DEBUG added function hardcoded_bind_all_interfaces (B104)
targeting Constant
[test_set] DEBUG added function hardcoded_password_default (B107)
targeting FunctionDef
[test_set] DEBUG added function hardcoded_password_funcarg (B106)
targeting Call
[test_set] DEBUG added function hardcoded_password_string (B105)
targeting Constant
[test_set] DEBUG added function hardcoded_sql_expressions (B608)
targeting Constant
[test_set] DEBUG added function hardcoded_tmp_directory (B108) targeting
Constant
[test_set] DEBUG added function hashlib_insecure_functions (B324)
targeting Call
[test_set] DEBUG added function jinja2_autoescape_false (B701) targeting
Call
[test_set] DEBUG added function linux_commands_wildcard_injection (B609)
targeting Call
[test_set] DEBUG added function logging_config_insecure_listen (B612)
targeting Call
[test_set] DEBUG added function paramiko_calls (B601) targeting Call
[test_set] DEBUG added function pytorch_load_save (B614) targeting Call
[test_set] DEBUG added function request_with_no_cert_validation (B501)
targeting Call
[test_set] DEBUG added function request_without_timeout (B113) targeting
Call
[test_set] DEBUG added function set_bad_file_permissions (B103)
targeting Call
[test_set] DEBUG added function snmp_insecure_version (B508) targeting
Call
[test_set] DEBUG added function snmp_weak_cryptography (B509) targeting
Call
[test_set] DEBUG added function ssh_no_host_key_verification (B507)
targeting Call
[test_set] DEBUG added function ssl_with_bad_defaults (B503) targeting
FunctionDef
[test_set] DEBUG added function ssl_with_bad_version (B502) targeting
Call
[test_set] DEBUG added function ssl_with_no_version (B504) targeting
Call
[test_set] DEBUG added function start_process_with_a_shell (B605)
targeting Call
[test_set] DEBUG added function start_process_with_no_shell (B606)
targeting Call
[test_set] DEBUG added function start_process_with_partial_path (B607)
targeting Call
[test_set] DEBUG added function subprocess_popen_with_shell_equals_true
(B602) targeting Call
[test_set] DEBUG added function subprocess_without_shell_equals_true
(B603) targeting Call
[test_set] DEBUG added function tarfile_unsafe_members (B202) targeting
Call
[test_set] DEBUG added function trojansource (B613) targeting File
[test_set] DEBUG added function try_except_continue (B112) targeting
ExceptHandler
[test_set] DEBUG added function try_except_pass (B110) targeting
ExceptHandler
[test_set] DEBUG added function use_of_mako_templates (B702) targeting
Call
[test_set] DEBUG added function weak_cryptographic_key (B505) targeting
Call
[test_set] DEBUG added function yaml_load (B506) targeting Call
[test_set] DEBUG added function blacklist (B001) targeting Call
[test_set] DEBUG added function blacklist (B001) targeting Import
[test_set] DEBUG added function blacklist (B001) targeting ImportFrom
[main] INFO running on Python 3.14.6
[manager] DEBUG working on file : /home/tao/testcase.py
[node_visitor] DEBUG Module qualified name: testcase
[node_visitor] DEBUG FunctionDef(name='main', args=arguments(),
body=[Expr(value=Call(func=Name(id='print', ctx=Load()),
args=[Constant(value='hello world')]))], returns=Name(id='int', ctx=Load()))
[meta_ast] DEBUG adding node : 0x7f710aa56550 [0]
[node_visitor] DEBUG entering: 0x7f710aa56550 <class 'ast.FunctionDef'> [0]
[node_visitor] DEBUG {'imports': set(), 'import_aliases': {}, 'lineno': 4,
'col_offset': 0, 'end_col_offset': 24, 'node': FunctionDef(name='main',
args=arguments(posonlyargs=[], args=[], vararg=None, kwonlyargs=[],
kw_defaults=[], kwarg=None, defaults=[]), body=[Expr(value=Call(func=Name(...),
args=[Constant(...)], keywords=[]))], decorator_list=[], returns=Name(id='int',
ctx=Load()), type_comment=None, type_params=[]), 'linerange': [4, 5],
'filename': '/home/tao/testcase.py', 'file_data': <_io.BufferedReader
name='/home/tao/testcase.py'>}
[node_visitor] DEBUG visit_FunctionDef called (FunctionDef(name='main',
args=arguments(), body=[Expr(value=Call(func=Name(id='print', ctx=Load()),
args=[Constant(value='hello world')]))], returns=Name(id='int', ctx=Load())))
[tester] DEBUG Returning scores: {'SEVERITY': [0, 0, 0, 0],
'CONFIDENCE': [0, 0, 0, 0]}
[node_visitor] DEBUG arguments()
[meta_ast] DEBUG adding node : 0x7f710aa56510 [1]
[node_visitor] DEBUG entering: 0x7f710aa56510 <class 'ast.arguments'> [1]
[node_visitor] DEBUG {'imports': set(), 'import_aliases': {}, 'node':
arguments(posonlyargs=[], args=[], vararg=None, kwonlyargs=[], kw_defaults=[],
kwarg=None, defaults=[]), 'linerange': [0, 1], 'filename':
'/home/tao/testcase.py', 'file_data': <_io.BufferedReader
name='/home/tao/testcase.py'>}
[tester] DEBUG Returning scores: {'SEVERITY': [0, 0, 0, 0],
'CONFIDENCE': [0, 0, 0, 0]}
[node_visitor] DEBUG 1 exiting : 0x7f710aa56510
[node_visitor] DEBUG Expr(value=Call(func=Name(id='print', ctx=Load()),
args=[Constant(value='hello world')]))
[meta_ast] DEBUG adding node : 0x7f710aa563d0 [1]
[node_visitor] DEBUG entering: 0x7f710aa563d0 <class 'ast.Expr'> [1]
[node_visitor] DEBUG {'imports': set(), 'import_aliases': {}, 'lineno': 5,
'col_offset': 4, 'end_col_offset': 24, 'node':
Expr(value=Call(func=Name(id='print', ctx=Load(...)),
args=[Constant(value='hello world', kind=None)], keywords=[])), 'linerange':
[5], 'filename': '/home/tao/testcase.py', 'file_data': <_io.BufferedReader
name='/home/tao/testcase.py'>}
[tester] DEBUG Returning scores: {'SEVERITY': [0, 0, 0, 0],
'CONFIDENCE': [0, 0, 0, 0]}
[node_visitor] DEBUG Call(func=Name(id='print', ctx=Load()),
args=[Constant(value='hello world')])
[meta_ast] DEBUG adding node : 0x7f710aa56390 [2]
[node_visitor] DEBUG entering: 0x7f710aa56390 <class 'ast.Call'> [2]
[node_visitor] DEBUG {'imports': set(), 'import_aliases': {}, 'lineno': 5,
'col_offset': 4, 'end_col_offset': 24, 'node': Call(func=Name(id='print',
ctx=Load()), args=[Constant(value='hello world', kind=None)], keywords=[]),
'linerange': [5], 'filename': '/home/tao/testcase.py', 'file_data':
<_io.BufferedReader name='/home/tao/testcase.py'>}
[node_visitor] DEBUG visit_Call called (Call(func=Name(id='print',
ctx=Load()), args=[Constant(value='hello world')]))
[tester] DEBUG Returning scores: {'SEVERITY': [0, 0, 0, 0],
'CONFIDENCE': [0, 0, 0, 0]}
[node_visitor] DEBUG Name(id='print', ctx=Load())
[meta_ast] DEBUG adding node : 0x7f710aa56350 [3]
[node_visitor] DEBUG entering: 0x7f710aa56350 <class 'ast.Name'> [3]
[node_visitor] DEBUG {'imports': set(), 'import_aliases': {}, 'lineno': 5,
'col_offset': 4, 'end_col_offset': 9, 'node': Name(id='print', ctx=Load()),
'linerange': [5], 'filename': '/home/tao/testcase.py', 'file_data':
<_io.BufferedReader name='/home/tao/testcase.py'>}
[tester] DEBUG Returning scores: {'SEVERITY': [0, 0, 0, 0],
'CONFIDENCE': [0, 0, 0, 0]}
[node_visitor] DEBUG Load()
[meta_ast] DEBUG adding node : 0x7f710bd363d0 [4]
[node_visitor] DEBUG entering: 0x7f710bd363d0 <class 'ast.Load'> [4]
[node_visitor] DEBUG {'imports': set(), 'import_aliases': {}, 'node':
Load(), 'linerange': [0, 1], 'filename': '/home/tao/testcase.py', 'file_data':
<_io.BufferedReader name='/home/tao/testcase.py'>}
[tester] DEBUG Returning scores: {'SEVERITY': [0, 0, 0, 0],
'CONFIDENCE': [0, 0, 0, 0]}
[node_visitor] DEBUG 4 exiting : 0x7f710bd363d0
[node_visitor] DEBUG 3 exiting : 0x7f710aa56350
[node_visitor] DEBUG Constant(value='hello world')
[meta_ast] DEBUG adding node : 0x7f710aa562d0 [3]
[node_visitor] DEBUG entering: 0x7f710aa562d0 <class 'ast.Constant'> [3]
[node_visitor] DEBUG {'imports': set(), 'import_aliases': {}, 'lineno': 5,
'col_offset': 10, 'end_col_offset': 23, 'node': Constant(value='hello world',
kind=None), 'linerange': [5], 'filename': '/home/tao/testcase.py', 'file_data':
<_io.BufferedReader name='/home/tao/testcase.py'>}
[node_visitor] DEBUG visit_Constant called (Constant(value='hello world'))
[manager] ERROR Exception occurred when executing tests against
/home/tao/testcase.py.
[manager] DEBUG Exception string: 'Constant' object has no attribute
's'
[manager] DEBUG Exception traceback: Traceback (most recent call
last):
File "/usr/lib/python3/dist-packages/bandit/core/manager.py", line 322, in
_parse_file
score = self._execute_ast_visitor(fname, fdata, data, nosec_lines)
File "/usr/lib/python3/dist-packages/bandit/core/manager.py", line 365, in
_execute_ast_visitor
score = res.process(data)
File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 286,
in process
self.generic_visit(f_ast)
~~~~~~~~~~~~~~~~~~^^^^^^^
File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 253,
in generic_visit
self.generic_visit(item)
~~~~~~~~~~~~~~~~~~^^^^^^
File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 253,
in generic_visit
self.generic_visit(item)
~~~~~~~~~~~~~~~~~~^^^^^^
File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 261,
in generic_visit
self.generic_visit(value)
~~~~~~~~~~~~~~~~~~^^^^^^^
File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 252,
in generic_visit
self.visit(item)
~~~~~~~~~~^^^^^^
File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 225,
in visit
visitor(node)
~~~~~~~^^^^^^
File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 159,
in visit_Constant
self.visit_Str(node)
~~~~~~~~~~~~~~^^^^^^
File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 171,
in visit_Str
self.context["str"] = node.s
^^^^^^
AttributeError: 'Constant' object has no attribute 's'
[main] DEBUG Node: 0x7f710aa56550
{'raw': FunctionDef(name='main', args=arguments(posonlyargs=[],
args=[], vararg=None, kwonlyargs=[], kw_defaults=[], kwarg=None, defaults=[]),
body=[Expr(value=Call(func=Name(...), args=[Constant(...)], keywords=[]))],
decorator_list=[], returns=Name(id='int', ctx=Load()), type_comment=None,
type_params=[]), 'parent_id': '', 'depth': 0}
Node: 0x7f710aa56510
{'raw': arguments(posonlyargs=[], args=[], vararg=None, kwonlyargs=[],
kw_defaults=[], kwarg=None, defaults=[]), 'parent_id': '', 'depth': 1}
Node: 0x7f710aa563d0
{'raw': Expr(value=Call(func=Name(id='print', ctx=Load(...)),
args=[Constant(value='hello world', kind=None)], keywords=[])), 'parent_id':
'', 'depth': 1}
Node: 0x7f710aa56390
{'raw': Call(func=Name(id='print', ctx=Load()),
args=[Constant(value='hello world', kind=None)], keywords=[]), 'parent_id': '',
'depth': 2}
Node: 0x7f710aa56350
{'raw': Name(id='print', ctx=Load()), 'parent_id': '', 'depth': 3}
Node: 0x7f710bd363d0
{'raw': Load(), 'parent_id': '', 'depth': 4}
Node: 0x7f710aa562d0
{'raw': Constant(value='hello world', kind=None), 'parent_id': '',
'depth': 3}
Length: 7
[main] DEBUG <bandit.core.metrics.Metrics object at 0x7f710abb70e0>
Run started:2026-07-05 17:31:35.562606
Test results:
No issues identified.
Code scanned:
Total lines of code: 4
Total lines skipped (#nosec): 0
Run metrics:
Total issues (by severity):
Undefined: 0
Low: 0
Medium: 0
High: 0
Total issues (by confidence):
Undefined: 0
Low: 0
Medium: 0
High: 0
Files skipped (1):
/home/tao/testcase.py (exception while scanning file)
Justification for severity:
* The tool is completely unusable since it fails on all program it's tested on
* Bandit is a security tool, and thus it's important that it works as well as
possible (obviously relying on just tools for security is a bad idea, but they
should still be used whenever possible)
The upstream version of Bandit is v1.9.4; I built a Debian package upgraded to
that version, and it seems to work just fine (after disabling the python-3.14
patch), so maybe the best solution is to simply package that version.
-- System Information:
Debian Release: forky/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 7.1.3+deb14-amd64 (SMP w/20 CPU threads; PREEMPT)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8),
LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages python3-bandit depends on:
ii python3 3.14.6-1
ii python3-git 3.1.50-1
ii python3-jschema-to-python 1.2.3-3
ii python3-rich 15.0.0-1
ii python3-sarif-python-om 1.0.4-3
ii python3-stevedore 5.7.0-3
ii python3-yaml 6.0.3-1
python3-bandit recommends no packages.
python3-bandit suggests no packages.
-- no debconf information
