Bandit, A shell=True Call Found At High Severity

bandit

The PyCQA CLI (bandit) on EL 10, pinned to a version, in a virtual environment of its own with a link in the PATH. Original role for EL 10, live-tested with podman on Rocky Linux 10.

There is no package; the documented install is pip. EL 10 carries no bandit, and pip install into the system Python ties the CLI's dependencies to whatever the OS ships. This role puts the CLI in /opt/bandit, a venv apart from the system Python: an OS update cannot break it, and it cannot break the OS. The live test asserts import bandit fails in /usr/bin/python3.

Pinned, and checked for consistency. bandit_version is what gets installed; the live test runs pip check inside the venv and expects no broken requirements.

pip verifies nothing beyond TLS. The index is PyPI over HTTPS; there is no signature to check. For a byte-for-byte pin, give bandit_pip_extra_args a requirements file with hashes and --require-hashes, or a private index.

Proven to run. The live test calls bandit -q /tmp/bandit-p/app.py and expects "B602" - the whole tree loaded and the Python security scanner did its work.

A shell=True call found at High severity. The live test writes a five-line module that passes a string to subprocess.call(..., shell=True) and expects B602 at Severity: High with exit code 1, then a clean module with exit code 0. Both directions of the exit code are proven, which is what a pre-commit hook or a CI step relies on.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.