Applying Bandit SAST Tool to Secure Python Applications

# Install using pip
pip install bandit

# Or install from source
git clone https://github.com/PyCQA/bandit.git
cd bandit
pip install .

# Scan a single file
bandit my_script.py

# Scan an entire directory
bandit -r my_project/

# Generate HTML report
bandit -r my_project/ -f html -o report.html

# Scan with specific security level
bandit -r my_project/ -l high

# vulnerable_app.py
import os
import pickle
import subprocess
import sqlite3

def process_user_input():
    # Vulnerability: Code injection
    user_input = input("Enter command: ")
    os.system(user_input)  # B602: subprocess_popen_with_shell_equals_true

def database_operations():
    # Vulnerability: SQL injection
    username = input("Enter username: ")
    conn = sqlite3.connect('users.db')
    cursor = conn.cursor()
    cursor.execute(f"SELECT * FROM users WHERE username = '{username}'")  # B608: hardcoded_sql_expressions

def data_deserialization():
    # Vulnerability: Insecure deserialization
    data = input("Enter serialized data: ")
    obj = pickle.loads(data.encode())  # B301: blacklist

bandit -r vulnerable_app.py -f txt

Results generated:
>> Issue: [B602:subprocess_popen_with_shell_equals_true] Using subprocess with shell=True
   Severity: High   Confidence: High
   Location: vulnerable_app.py:8
   More Info: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b602-subprocess-popen-with-shell-equals-true
7    user_input = input("Enter command: ")
8    os.system(user_input)

>> Issue: [B608:hardcoded_sql_expressions] Possible SQL injection vector through string-based query construction.
   Severity: Medium   Confidence: Medium
   Location: vulnerable_app.py:15
15    cursor.execute(f"SELECT * FROM users WHERE username = '{username}'")

>> Issue: [B301:blacklist] Use of unsafe deserialization function.
   Severity: High   Confidence: High
   Location: vulnerable_app.py:20
20    obj = pickle.loads(data.encode())

# bandit.yml
exclude_dirs: ['tests', 'venv', 'migrations']
skips: ['B101', 'B102']
tests: ['B301', 'B302', 'B601', 'B602']

targets:
  - src/
  - app/

output_format: json
verbose: true

bandit -c bandit.yml -r my_project/

name: Security Scan with Bandit
on: [push, pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.9'

      - name: Install Bandit
        run: pip install bandit

      - name: Run Bandit Security Scan
        run: bandit -r . -f json -o bandit-report.json

      - name: Upload Bandit Report
        uses: actions/upload-artifact@v3
        with:
          name: bandit-report
          path: bandit-report.json

# custom_checks.py
import bandit
from bandit.core import test_properties as test

@test.checks('Call')
@test.test_id('B901')
def hardcoded_api_key(context):
    """Check for hardcoded API keys"""
    suspicious_strings = ['api_key', 'secret_key', 'password']
    if context.call_function_name_qual in suspicious_strings:
        return bandit.Issue(
            severity=bandit.HIGH,
            confidence=bandit.MEDIUM,
            text="Potential hardcoded API key detected"
        )

bandit -r my_project/ -p custom_checks.py

# Pre-commit hook example
# .git/hooks/pre-commit
#!/bin/bash
bandit -r . -l high -i

# GitHub Actions scheduled scan
on:
  schedule:
    - cron: '0 2 * * 1'  # Weekly scan

# Establish baseline ignoring existing issues
bandit -r . --baseline baseline.json

# Fail build on high severity issues
bandit -r . -l high --exit-zero