Security Testing & Auditing

# Run on your project
bandit -r ./src -f json -o security_report.json

# Run with specific severity threshold
bandit -r ./src -l -ll    # Only show MEDIUM and HIGH severity

# ── Example vulnerable code that bandit catches ───────────────
# vulnerable_code.py
import subprocess
import hashlib
import random

# B603: subprocess without shell=True but with user data, flagged
user_input = "untrusted data"
subprocess.run(user_input, shell=True)      # B602: HIGH severity

# B324: hashlib with MD5, flagged
hash_value = hashlib.md5(b"password").hexdigest()   # B324: MEDIUM severity

# B311: Standard pseudo-random generators, flagged for security use
token = str(random.randint(0, 1000000))     # B311: MEDIUM severity
# Fix: use secrets.token_hex() instead

# ── Interpret bandit JSON output ──────────────────────────────
import json

example_output = {
    "results": [
        {
            "filename": "vulnerable_code.py",
            "line_number": 8,
            "test_id": "B602",
            "issue_text": "subprocess call with shell=True identified, security issue.",
            "issue_severity": "HIGH",
            "issue_confidence": "HIGH",
        },
        {
            "filename": "vulnerable_code.py",
            "line_number": 11,
            "test_id": "B324",
            "issue_text": "Use of insecure MD2, MD4, MD5, or SHA1 hash function.",
            "issue_severity": "MEDIUM",
            "issue_confidence": "HIGH",
        },
    ]
}

for issue in example_output["results"]:
    severity = issue["issue_severity"]
    color = "❌" if severity == "HIGH" else "⚠️"
    print(f"{color} [{severity}] {issue['test_id']} line {issue['line_number']}: {issue['issue_text'][:60]}")

# security_audit.py, Run all security checks in one script
import subprocess
import sys
import json
from pathlib import Path

def run_bandit(path: str) -> tuple[bool, int]:
    """Run bandit SAST. Returns (passed, high_severity_count)."""
    try:
        result = subprocess.run(
            ["bandit", "-r", path, "-f", "json", "-q"],
            capture_output=True, text=True, timeout=60
        )
        data = json.loads(result.stdout or "{}")
        high_issues = sum(1 for i in data.get("results", [])
                          if i.get("issue_severity") == "HIGH")
        return high_issues == 0, high_issues
    except (FileNotFoundError, json.JSONDecodeError):
        return False, -1

def run_pip_audit() -> tuple[bool, int]:
    """Run pip-audit for CVE scanning."""
    try:
        result = subprocess.run(
            ["pip", "audit", "--format=json"],
            capture_output=True, text=True, timeout=120
        )
        data = json.loads(result.stdout or "[]")
        vuln_count = len(data)
        return vuln_count == 0, vuln_count
    except (FileNotFoundError, json.JSONDecodeError):
        return False, -1

def check_env_file_not_in_git() -> bool:
    """Ensure .env file is in .gitignore."""
    gitignore = Path(".gitignore")
    if not gitignore.exists():
        return False
    content = gitignore.read_text()
    return ".env" in content

def run_full_audit(source_path: str = "./src") -> bool:
    print("=" * 50)
    print("  SECURITY AUDIT REPORT")
    print("=" * 50)

    checks = []

    passed, highs = run_bandit(source_path)
    checks.append(("bandit SAST (no HIGH issues)", passed,
                    f"{highs} HIGH issues" if not passed else "Clean"))

    passed, vulns = run_pip_audit()
    checks.append(("pip-audit (no CVEs)", passed,
                    f"{vulns} vulnerabilities" if not passed else "Clean"))

    env_safe = check_env_file_not_in_git()
    checks.append((".env in .gitignore", env_safe, "Add .env to .gitignore" if not env_safe else ""))

    total_passed = sum(1 for _, p, _ in checks if p)
    for name, passed, detail in checks:
        icon = "✅" if passed else "❌"
        print(f"  {icon} {name}")
        if not passed and detail:
            print(f"       → {detail}")

    print(f"\nResult: {total_passed}/{len(checks)} checks passed")
    return total_passed == len(checks)

success = run_full_audit()
sys.exit(0 if success else 1)