From 9f35cb6a1746d98750cbf8b2f277613727ae38f8 Mon Sep 17 00:00:00 2001 From: Abdul Samad Date: Fri, 26 Jun 2026 17:17:13 +0500 Subject: [PATCH] fix(cli): clamp severity/confidence counts to valid ranking range Repeated -l/-i flags can push severity or confidence past the RANKING index range and crash with IndexError. Clamp counts before mapping to ranking labels and add regression tests. Fixes #1423 --- bandit/cli/main.py | 12 ++++++++++-- tests/unit/cli/test_main.py | 25 +++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 2 deletions(-) diff --git a/bandit/cli/main.py b/bandit/cli/main.py index d7dba2efa..760be502c 100644 --- a/bandit/cli/main.py +++ b/bandit/cli/main.py @@ -20,6 +20,14 @@ LOG = logging.getLogger() +def _ranking_level(count): + """Return a ranking label for a CLI severity/confidence count.""" + if count is None: + count = 1 + index = min(max(count, 1), len(constants.RANKING)) - 1 + return constants.RANKING[index] + + def _init_logger(log_level=logging.INFO, log_format=None): """Initialize the logger. @@ -677,8 +685,8 @@ def main(): LOG.debug(b_mgr.metrics) # trigger output of results by Bandit Manager - sev_level = constants.RANKING[args.severity - 1] - conf_level = constants.RANKING[args.confidence - 1] + sev_level = _ranking_level(args.severity) + conf_level = _ranking_level(args.confidence) b_mgr.output_results( args.context_lines, sev_level, diff --git a/tests/unit/cli/test_main.py b/tests/unit/cli/test_main.py index 98b95ec01..9930b43bc 100644 --- a/tests/unit/cli/test_main.py +++ b/tests/unit/cli/test_main.py @@ -175,6 +175,31 @@ def test_log_option_source_no_values(self): bandit._log_option_source(None, None, None, option_name) ) + def test_ranking_level_clamps_excess_counts(self): + self.assertEqual("HIGH", bandit._ranking_level(4)) + self.assertEqual("HIGH", bandit._ranking_level(5)) + self.assertEqual("HIGH", bandit._ranking_level(100)) + + def test_ranking_level_handles_none(self): + self.assertEqual("UNDEFINED", bandit._ranking_level(None)) + + @mock.patch( + "sys.argv", + ["bandit", "-c", "bandit.yaml", "-ii", "-ll", "-ii", "-ll", "test.py"], + ) + def test_main_repeated_severity_confidence_flags(self): + temp_directory = self.useFixture(fixtures.TempDir()).path + os.chdir(temp_directory) + with open("bandit.yaml", "w") as fd: + fd.write(bandit_config_content) + with open("test.py", "w") as fd: + fd.write("") + with mock.patch( + "bandit.core.manager.BanditManager.results_count" + ) as mock_mgr_results_ct: + mock_mgr_results_ct.return_value = 0 + self.assertRaisesRegex(SystemExit, "0", bandit.main) + @mock.patch("sys.argv", ["bandit", "-c", "bandit.yaml", "test"]) def test_main_config_unopenable(self): # Test that bandit exits when a config file cannot be opened