Skip to content

Tags

Tags give the ability to mark specific points in history as being important

  • 0.16.2

    72b5e2c1 · Merge "Updated from global requirements" · 
    Bandit 0.16.2

[New Features]
 - added new config file generating tool

[Behind the Scenes]
 - new functional runtime unit tests added
 - improved the node visitor code
 - removed some dead code
 - simplified baseline matching function
    Unverified

  • 0.16.1

    2d96febc · Fixing a simple issue in results count to fix exit code · 
    Fix for baseline return codes
    Unverified

  • 0.16.0

    83d5d843 · Merge "os.system et al. all spawn a shell so we should use the same logic" · 
    Bandit 0.16.0

[New Features]
- Revamped baseline detection and reporting

[Enhancements
- Added support for some Python 3 versions of blacklisted calls
- Improved appearance of HTML report
- Shell subprocess calls use same improved logic as shell=True calls

[Behind the Scenes]
- Fixed a bug in the shell injection test
- Fixed a bug in text formatter excluded files listing
- Fixed a bug when processing a tuple as a function parameter
- Added a new test case for a constructed subprocess call
    Unverified

  • 0.15.2

    2a328eb7 · Fixing bug in injection test · 
    - minor bug fix to shell injection detection test
    Unverified

  • 0.15.1

    3157f0d6 · Merge "Fixing Baseline when a filter is used" · 
    Bandit 0.15.1

[Enhancements]
- Add missing HTTP verbs to request checks
- Making score output more useful in text/json formatters

[Behind the Scenes]
- Remove coverage files after run
- Fixing baseline functionality when using filters
- Fixing an error when specifying bad input files
    Unverified

  • 0.15.0

    f571ff03 · Merge "Adding plugin to output in text formatter" · 
    Bandit 0.15.0

[New Features]
 - new plugin that checks for Flask with debug=True
 - "baseline" reporting

[Enhancements]
 - plugin names now shown in reports
 - metrics now shown in HTML report
 - HTML report styling done with CSS
 - changed oslo secret config option confidence
 - distinguished levels of command injection findings

[Behind the Scenes]
 - misc improvements
 - refactored metrics code

[Documentation]
 - added a few missing topics
 - added links to relevant security development guidance
    Unverified

  • 0.14.1

    aa66e18d · Adding command line option to exclude paths · 
    [New Features]

* Adding command line option to exclude paths
* Tweaks to #nosec (+ ignore flag, - dead constant)
* Add metrics to text and JSON output formatters
* Include context in debug output
* Tidy up plugin list in 'bandit -h' output
    Unverified

  • 0.14.0

    a0f39927 · Merge "Adding docs for Jinja2 autoescape" · 
    [New functionality]
* Add a new check for weak RSA and DSA key sizes
* Add known weak ciphers to blacklisted calls
* Check for insecure cipher modes
* Adding HTML formatter
* Add Bytes AST support

[Notable Improvements]
* Adding documentation for all current tests
* Making the /tmp file test more accurate
* Adding new improved hardcoded password tests
* Increasing unit test coverage
* Split each formatter into separate modules
* Refactored (removed) the old Result Store
* Adding test tool for check OpenStack projects' Bandit job
* Introduce wildcards to blacklist_calls plugin

[Misc]
* Various cleanups in bandit.yaml
* Various performance improvements
* Various Py3 compatibility improvements
* Fixing various bugs
* Tidying up various things in the code base
* Removing (broken) argument printing
* Remove tox envirnoment for pypy
* Skip '/tests/' by default
* Raise exceptions from BanditConfig rather than exit
* Better function to count lines in a file
    Unverified

  • 0.13.2

    8cecf885 · Find bandit.yaml when in virtualenv · 
    Fixing an issue with finding config in virtualenv
    Unverified

  • 0.13.1

    3b6acb73 · Merge "Add other known weak MD hash modules" · 
    More graceful handling of missing plugin config
    Unverified

  • 0.13.0

    80c7798e · Actually default to /etc/ rather than just claim · 
    Bandit Version 0.13.0

Introduces the following improvements:

Plugins now registered as entry points
Improved Bandit run speed
Added a confidence filter option
Added timestamp to JSON report
New plugin to detect Try, Except, Pass
Improved detection for hardcoded /tmp
    plugin
Produce universal wheel
Created an example profile which lists
    all current plugins
Updated readme and formatting
Fixed a bug where correct error code was
    not sent when filtering results
Fixed a bug in SQL injection plugin and
    improved detection
Bundled wordlist for hardcoded password
    plugin
Other enhancements, bug fixes, and
    improvements
    Unverified

  • 0.12.0

    36e28b33 · Address multiline node lineno inaccuracies · 
    Bandit 0.12.0

New since last version:
 - Fixed multiline string line number reporting
 - Stevedore based extension system
 - New paramiko shell injection test
 - Misc bug fixes
 - Updated README file
 - Added verbose output flag
 - Added Python 3.4 compatibility
 - Reported version of Python Bandit is using
 - Added documentation for some plugins
 - Added XML output support
    Unverified

  • 0.11.0

    f11e9b8a · Update the README file · 
    0.11.0

- Fix config installation for bdist
- Add confidence metric
- Add xml plugin
- Add assert usage plugin
- Add csv output format
- Misc bug fixes
- Refactored some code
- Updated README
    Unverified

  • 0.10.1

    26002c40 · Fixing info output that was breaking JSON format · 
    Bundle config with binary install
    Unverified

  • 0.10.0

    bf0a33c5 · Fixing a bug with files listing when a file was skipped · 
    Initial PyPI release version
    Unverified

  • 0.9.0

    09f0fa9c · Remove the check for PROTOCOL_SSLv23 · 
    Initial Bandit release
    Unverified