.bandit.yaml

profile:
  sql:
    exclude:
      - /commons/c2cgeoportal_commons/alembic/main/
      - /commons/c2cgeoportal_commons/alembic/static/
    tests:
      - B608 # Possible SQL injection vector through string-based query construction.
  subprocess:
    exclude:
      - /commons/c2cgeoportal_commons/testing/
      - /commons/tests/
      - /geoportal/tests/
      - /geoportal/c2cgeoportal_geoportal/scripts/c2cupgrade.py
      - /admin/tests/
    tests:
      - B603 # subprocess call - check for execution of untrusted input.
      - B607 # Starting a process with a partial executable path
      - B404 # Consider possible security implications associated with call module.
  tmp:
    exclude:
      - /geoportal/c2cgeoportal_geoportal/scripts/c2cupgrade.py
    tests:
      - B108 # Probable insecure usage of temp file/directory.
skips:
  - B101 # Test for use of assert
  - B603 # subprocess call - check for execution of untrusted input.
  - B607 # Starting a process with a partial executable path
  - B608 # Possible SQL injection vector through string-based query construction.
  - B108 # Probable insecure usage of temp file/directory.
  - B404 # Consider possible security implications associated with call module.
  - B113 # Requests call without timeout. Done by c2cwsgiutils