bandit

.. image:: https://raw.githubusercontent.com/pycqa/bandit/main/logo/logotype-sm.png :alt: Bandit

======

.. image:: https://github.com/PyCQA/bandit/actions/workflows/pythonpackage.yml/badge.svg?branch=main :target: https://github.com/PyCQA/bandit/actions?query=workflow%3A%22Build+and+Test+Bandit%22+branch%3Amain :alt: Build Status

.. image:: https://readthedocs.org/projects/bandit/badge/?version=latest :target: https://readthedocs.org/projects/bandit/ :alt: Docs Status

.. image:: https://img.shields.io/pypi/v/bandit.svg :target: https://pypi.org/project/bandit/ :alt: Latest Version

.. image:: https://img.shields.io/pypi/pyversions/bandit.svg :target: https://pypi.org/project/bandit/ :alt: Python Versions

.. image:: https://img.shields.io/pypi/format/bandit.svg :target: https://pypi.org/project/bandit/ :alt: Format

.. image:: https://img.shields.io/badge/license-Apache%202-blue.svg :target: https://github.com/PyCQA/bandit/blob/main/LICENSE :alt: License

.. image:: https://img.shields.io/discord/825463413634891776.svg :target: https://discord.gg/qYxpadCgkx :alt: Discord

来自PyCQA的安全代码检查工具

• 自由软件：Apache许可证
• 文档：https://bandit.readthedocs.io/en/latest/
• 源代码：https://github.com/PyCQA/bandit
• Bug反馈：https://github.com/PyCQA/bandit/issues
• 贡献指南：https://github.com/PyCQA/bandit/blob/main/CONTRIBUTING.md

概述

Bandit 是一款旨在发现 Python 代码中常见安全问题的工具。为此，Bandit 会处理每个文件，构建其抽象语法树（AST），并针对 AST 节点运行相应的插件。当 Bandit 完成所有文件的扫描后，它会生成一份报告。

Bandit 最初是在 OpenStack 安全项目内部开发的，后来迁至 PyCQA。

.. image:: https://raw.githubusercontent.com/pycqa/bandit/main/bandit-terminal.png :alt: Bandit 示例截图

展示你的风格

.. image:: https://img.shields.io/badge/security-bandit-yellow.svg :target: https://github.com/PyCQA/bandit :alt: Security Status

在你的项目README中使用我们的徽章！

using Markdown::

[![security: bandit](https://img.shields.io/badge/security-bandit-yellow.svg)](https://github.com/PyCQA/bandit)

using RST::

.. image:: https://img.shields.io/badge/security-bandit-yellow.svg
    :target: https://github.com/PyCQA/bandit
    :alt: Security Status

参考

Python AST 模块文档：https://docs.python.org/3/library/ast.html

Green Tree Snakes - 缺失的 Python AST 文档： https://greentreesnakes.readthedocs.org/en/latest/

Bandit 当前覆盖或可扩展覆盖的各种 AST 节点类型的文档： https://greentreesnakes.readthedocs.org/en/latest/nodes.html

容器镜像

Bandit 可作为容器镜像使用，通过 GitHub Actions 在 bandit 仓库内构建。该镜像可在 ghcr.io 获取：

.. code-block:: console

docker pull ghcr.io/pycqa/bandit/bandit

该镜像为以下架构构建：

• amd64
• arm64
• armv7
• armv8

要拉取特定架构，请使用以下格式：

.. code-block:: console

docker pull --platform=<architecture> ghcr.io/pycqa/bandit/bandit:latest

每个镜像均使用 sigstore cosign 签名，并可通过以下 cosign 命令验证来源：

.. code-block:: console

cosign verify ghcr.io/pycqa/bandit/bandit:latest \
  --certificate-identity https://github.com/pycqa/bandit/.github/workflows/build-publish-image.yml@refs/tags/<version> \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

其中 <version> 是 Bandit 的发布版本。

赞助商

Bandit 的开发离不开以下赞助商的支持：

.. list-table:: :width: 100% :class: borderless

• • .. image:: https://avatars.githubusercontent.com/u/34240465?s=200&v=4 :target: https://opensource.mercedes-benz.com/ :alt: Mercedes-Benz :width: 88

  • .. image:: https://github.githubassets.com/assets/tidelift-8cea37dea8fc.svg :target: https://tidelift.com/lifter/search/pypi/bandit :alt: Tidelift :width: 88

  • .. image:: https://avatars.githubusercontent.com/u/110237746?s=200&v=4 :target: https://stacklok.com/ :alt: Stacklok :width: 88

如果你也 ❤️ Bandit，请考虑赞助我们。