mirror of
https://github.com/NicolasBohn/NexQuant.git
synced 2026-07-27 15:37:44 +00:00
TPTBusiness
f3a2e2b4f1
- Add Bandit security scanner to requirements and pre-commit hooks - Fix CWE-22 path traversal in tarfile/zipfile extraction (3 files) * Add _safe_extract() validation in submit.py, env.py, kaggle_crawler.py * Prevents malicious archives from writing outside target directory - Fix MD5 hashlib calls with usedforsecurity=False flag (2 files) * submission_format_test.txt files for checksum validation - Configure .bandit.yml for automated security scanning * Skip known false positives: B602 (subprocess), B701 (Jinja2) - Add security runbook documentation in docs/security/ - Add pre-commit hook scripts for automated Bandit scanning All 106 backtesting and security tests pass. Security issues resolved: B201, B202, B324 (9 total fixes)
40 lines
1.1 KiB
Bash
40 lines
1.1 KiB
Bash
#!/bin/bash
|
|
# Bandit Security Scanner Wrapper for Pre-Commit
|
|
# This script runs Bandit with the correct configuration
|
|
# Usage: .pre-commit-hooks/run_bandit.sh [files...]
|
|
|
|
set -e
|
|
|
|
BANDIT_CONFIG=".bandit.yml"
|
|
SCAN_DIR="rdagent/"
|
|
EXCLUDE_DIRS="test/,.git/,.qwen/,results/,git_ignore_folder/"
|
|
EXCLUDE_FILES="rdagent/scenarios/qlib/proposal/bandit.py"
|
|
|
|
echo "🔒 Running Bandit Security Scanner..."
|
|
echo " Config: ${BANDIT_CONFIG}"
|
|
echo " Scan: ${SCAN_DIR}"
|
|
echo ""
|
|
|
|
# Run bandit with high severity threshold
|
|
# Exit code 1 if any HIGH severity issues found
|
|
bandit \
|
|
--configfile "${BANDIT_CONFIG}" \
|
|
--severity-level high \
|
|
--confidence-level medium \
|
|
--format txt \
|
|
--recursive "${SCAN_DIR}" \
|
|
--exclude "${EXCLUDE_DIRS},${EXCLUDE_FILES}" \
|
|
"$@"
|
|
|
|
exit_code=$?
|
|
|
|
if [ $exit_code -eq 0 ]; then
|
|
echo "✅ No HIGH severity security issues found"
|
|
else
|
|
echo "⚠️ HIGH severity security issues detected!"
|
|
echo " Review issues above and fix before committing."
|
|
echo " To suppress false positives, add # nosec BXXX to the line."
|
|
fi
|
|
|
|
exit $exit_code
|