add support for Bandit security analyzer

mmgen/color.py

@@ -53,7 +53,7 @@ def set_vt100():
 	'hack to put term into VT100 mode under MSWin'
 	if gc.platform == 'win32':
 		from subprocess import run
-		run([], shell=True)
+		run([], shell=True) # nosec
 
 def get_terminfo_colors(term=None):
 	from subprocess import run, PIPE
@@ -106,13 +106,13 @@ def init_color(num_colors='auto'):
 				start = (
 					'\033[38;5;{};1m'.format(e[0]) if type(e[0]) == int else
 					'\033[38;5;{};48;5;{};1m'.format(*e[0]))
-				getattr(self, c).__code__ = eval(f'(lambda s: "{start}" + s + "{reset}").__code__')
+				getattr(self, c).__code__ = eval(f'(lambda s: "{start}" + s + "{reset}").__code__') # nosec
 		case 8 | 16:
 			for c, e in _colors.items():
 				start = (
 					'\033[{}m'.format(e[1][0]) if e[1][1] == 0 else
 					'\033[{};{}m'.format(*e[1]))
-				getattr(self, c).__code__ = eval(f'(lambda s: "{start}" + s + "{reset}").__code__')
+				getattr(self, c).__code__ = eval(f'(lambda s: "{start}" + s + "{reset}").__code__') # nosec
 
 	set_vt100()
 

mmgen/util2.py

@@ -94,7 +94,7 @@ def get_keccak(cfg=None, cached_ret=[]):
 			from .contrib.keccak import keccak_256
 		elif not (keccak_256 := get_hashlib_keccak()):
 			load_cryptodome()
-			from Crypto.Hash import keccak # pylint: disable=import-error
+			from Crypto.Hash import keccak # nosec # pylint: disable=import-error
 			keccak_256 = lambda data: keccak.new(data=data, digest_bytes=32)
 		cached_ret.append(keccak_256)
 

pyproject.toml

@@ -6,6 +6,11 @@ requires = [
 ]
 build-backend = "setuptools.build_meta"
 
+[tool.bandit]
+skips = [
+	"B108", # hardcoded_tmp_directory: probable insecure usage of temp file/directory
+]
+
 [tool.ruff]
 line-length = 106
 indent-width = 4

test/test-release.d/cfg.sh

@@ -8,7 +8,7 @@
 #   https://github.com/mmgen/mmgen-wallet
 #   https://gitlab.com/mmgen/mmgen-wallet
 
-all_tests="dep dev ruff pylint obj color daemon mod hash ref altref altgen xmr geth reth autosign btc btc_tn btc_rt bch bch_tn bch_rt ltc ltc_tn ltc_rt tool tool2 gen alt help"
+all_tests="dep dev ruff pylint bandit obj color daemon mod hash ref altref altgen xmr geth reth autosign btc btc_tn btc_rt bch bch_tn bch_rt ltc ltc_tn ltc_rt tool tool2 gen alt help"
 
 groups_desc="
 	default  - All tests minus the extra tests
@@ -20,7 +20,7 @@ groups_desc="
 
 init_groups() {
 	dfl_tests='dep daemon alt obj color mod hash ref tool tool2 gen help autosign btc btc_tn btc_rt altref altgen bch bch_rt ltc ltc_rt geth reth etc rune xmr'
-	extra_tests='dep dev ruff pylint autosign_live ltc_tn bch_tn'
+	extra_tests='dep dev ruff pylint bandit autosign_live ltc_tn bch_tn'
 	noalt_tests='dep daemon alt obj color mod hash ref tool tool2 gen help autosign btc btc_tn btc_rt'
 	quick_tests='dep daemon alt obj color mod hash ref tool tool2 gen help autosign btc btc_rt altref altgen geth etc rune xmr'
 	qskip_tests='ruff btc_tn bch bch_rt ltc ltc_rt'
@@ -93,6 +93,12 @@ init_tests() {
 	"
 	if [ "$SKIP_ALT_DEP" ]; then t_pylint_skip='b'; else t_pylint_skip='a'; fi
 
+	d_bandit="code vulnerabilities with Bandit static analyzer"
+	e_bandit="Error checking failed!"
+	t_bandit="
+		- $bandit mmgen
+	"
+
 	d_daemon="low-level subsystems involving coin daemons"
 	t_daemon="- $daemontest_py --exclude exec"
 

test/test-release.sh

@@ -279,6 +279,7 @@ altcoin_mod_opts='--quiet'
 mmgen_tool='cmds/mmgen-tool'
 pylint='pylint'
 ruff='ruff --silent'
+bandit='bandit --silent --recursive --severity-level=medium --configfile=pyproject.toml'
 python='python3'
 rounds=10
 typescript_file='test-release.out'
@@ -375,6 +376,7 @@ do
 		objattrtest_py+=" --verbose"
 		pylint+=" --verbose"
 		ruff="${ruff/' --silent'}"
+		bandit="${bandit/' --silent'}"
 		scrambletest_py+=" --verbose" ;;
 	X)  IN_REEXEC=1 ;;
 	*)  exit ;;