bump ruff to 0.0.260 and enable bandit (#9300)

* bump ruff to 0.0.260 and enable bandit

* install toml extra for bandit

* suppress insecure use of hash md5

.pre-commit-config.yaml

@@ -43,7 +43,7 @@ repos:
     hooks:
       - id: isort
   - repo: https://github.com/charliermarsh/ruff-pre-commit
-    rev: 'v0.0.257'
+    rev: 'v0.0.260'
     hooks:
       - id: ruff
   - repo: https://github.com/codespell-project/codespell
@@ -61,6 +61,13 @@ repos:
           - flake8-debugger
           - flake8-string-format
           - flake8-typing-imports
+  - repo: https://github.com/PyCQA/bandit
+    rev: '1.7.5'
+    hooks:
+    - id: bandit
+      args: ["-c", "pyproject.toml", "--quiet", "--format=custom"]
+      files: ^dvc/
+      additional_dependencies: [".[toml]"]
   - repo: local
     hooks:
     - id: mypy

dvc/commands/completion.py

@@ -15,7 +15,7 @@ class CmdCompletion(CmdBaseNoRepo):
 
         shell = self.args.shell
         parser = self.args.parser
-        script = shtab.complete(parser, shell=shell, preamble=PREAMBLE)
+        script = shtab.complete(parser, shell=shell, preamble=PREAMBLE)  # nosec B604
         ui.write(script, force=True)
         return 0
 

dvc/daemon.py

@@ -5,7 +5,7 @@ import logging
 import os
 import platform
 import sys
-from subprocess import Popen
+from subprocess import Popen  # nosec B404
 from typing import List
 
 from dvc.env import DVC_DAEMON
@@ -28,12 +28,12 @@ def _popen(cmd, **kwargs) -> Popen:
             os.path.abspath(os.path.dirname(__file__)), "__main__.py"
         )
         prefix += [main_entrypoint]
-    return Popen(prefix + cmd, close_fds=True, shell=False, **kwargs)
+    return Popen(prefix + cmd, close_fds=True, shell=False, **kwargs)  # nosec B603
 
 
 def _spawn_windows(cmd, env):
     if sys.platform == "win32":
-        from subprocess import (
+        from subprocess import (  # nosec B404
             CREATE_NEW_PROCESS_GROUP,
             CREATE_NO_WINDOW,
             STARTF_USESHOWWINDOW,

dvc/lock.py

@@ -187,7 +187,9 @@ class HardlinkLock(flufl.lock.Lock, LockBase):
 
         if self._tmp_dir is not None:
             # Under Windows file path length is limited so we hash it
-            hasher = hashlib.md5(self._claimfile.encode())  # noqa: S324
+            hasher = hashlib.md5(  # nosec B324, B303  # noqa: S324
+                self._claimfile.encode()
+            )
             filename = hasher.hexdigest()
             self._claimfile = os.path.join(self._tmp_dir, filename + ".lock")
 

dvc/logger.py

@@ -146,7 +146,8 @@ class LoggerHandler(logging.StreamHandler):
                         self.emit_pretty_exception(exc, verbose=_is_verbose())
                         if not _is_verbose():
                             return
-                    except Exception:  # noqa, pylint: disable=broad-except
+                    # pylint: disable-next=broad-except
+                    except Exception:  # noqa: BLE001, S110  # nosec B110
                         pass
 
             msg = self.format(record)

dvc/parsing/interpolate.py

@@ -73,7 +73,7 @@ def embrace(s: str):
 
 def escape_str(value):
     if os.name == "nt":
-        from subprocess import list2cmdline
+        from subprocess import list2cmdline  # nosec B404
 
         return list2cmdline([value])
     from shlex import quote

dvc/repo/__init__.py

@@ -585,10 +585,10 @@ class Repo:
         finally:
             os.umask(umask)
 
-        repo_token = hashlib.md5(  # noqa: S324
+        md5 = hashlib.md5(  # noqa: S324  # nosec B324, B303
             str((root_dir, getpass.getuser())).encode()
-        ).hexdigest()
-
+        )
+        repo_token = md5.hexdigest()
         return os.path.join(repos_dir, repo_token)
 
     def close(self):

dvc/repo/experiments/executor/base.py

@@ -1,6 +1,6 @@
 import logging
 import os
-import pickle
+import pickle  # nosec B403
 from abc import ABC, abstractmethod
 from contextlib import contextmanager
 from dataclasses import asdict, dataclass
@@ -361,7 +361,7 @@ class BaseExecutor(ABC):
     @staticmethod
     def unpack_repro_args(path):
         with open(path, "rb") as fobj:
-            data = pickle.load(fobj)
+            data = pickle.load(fobj)  # noqa: S301 # nosec B301
         return data["args"], data["kwargs"]
 
     def fetch_exps(

dvc/repo/experiments/queue/base.py

@@ -496,7 +496,7 @@ class BaseStashQueue(ABC):
         return msg
 
     def _pack_args(self, *args, **kwargs) -> None:
-        import pickle
+        import pickle  # nosec B403
 
         if os.path.exists(self.args_file) and self.scm.is_tracked(self.args_file):
             logger.warning(
@@ -511,7 +511,7 @@ class BaseStashQueue(ABC):
             )
             with open(self.args_file, "rb") as fobj:
                 try:
-                    data = pickle.load(fobj)
+                    data = pickle.load(fobj)  # noqa: S301  # nosec B301
                 except Exception:  # noqa: BLE001, pylint: disable=broad-except
                     data = {}
             extra = int(data.get("extra", 0)) + 1

dvc/repo/index.py

@@ -264,7 +264,7 @@ class Index:
 
     def check_graph(self) -> None:
         if not getattr(self.repo, "_skip_graph_checks", False):
-            self.graph  # pylint: disable=pointless-statement
+            self.graph  # noqa: B018, pylint: disable=pointless-statement
 
     @property
     def params(self) -> Iterator["ParamsDependency"]:

dvc/stage/monitor.py

@@ -1,7 +1,7 @@
 import functools
 import logging
 import os
-import subprocess
+import subprocess  # nosec B404
 import threading
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, Callable, List
@@ -96,7 +96,9 @@ class Monitor:
     def _kill_nt(proc):
         # windows stages are spawned with shell=True, proc is the shell process
         # and not the actual stage process - we have to kill the entire tree
-        subprocess.call(["taskkill", "/F", "/T", "/PID", str(proc.pid)])
+        subprocess.call(  # nosec B607, B603
+            ["taskkill", "/F", "/T", "/PID", str(proc.pid)]
+        )
 
     @staticmethod
     def _loop(tasks: List[MonitorTask], done: threading.Event):

dvc/stage/run.py

@@ -1,7 +1,7 @@
 import logging
 import os
 import signal
-import subprocess
+import subprocess  # nosec B404
 import threading
 from typing import TYPE_CHECKING, List
 
@@ -86,7 +86,7 @@ def _run(stage: "Stage", executable, cmd, checkpoint_func, **kwargs):
     exec_cmd = _make_cmd(executable, cmd)
 
     try:
-        p = subprocess.Popen(exec_cmd, **kwargs)
+        p = subprocess.Popen(exec_cmd, **kwargs)  # nosec B603
         if main_thread:
             old_handler = signal.signal(signal.SIGINT, signal.SIG_IGN)
 

dvc/testing/fixtures.py

@@ -1,5 +1,5 @@
 import os
-import subprocess
+import subprocess  # nosec B404
 from typing import Dict, Tuple
 
 import pytest
@@ -233,14 +233,16 @@ def docker_services(
         pytest.skip("disabled for Windows on CI")
 
     try:
-        subprocess.check_output("docker ps", stderr=subprocess.STDOUT, shell=True)
+        subprocess.check_output(  # nosec B607, B602
+            "docker ps", stderr=subprocess.STDOUT, shell=True
+        )
     except subprocess.CalledProcessError as err:
         out = (err.output or b"").decode("utf-8")
         pytest.skip(f"docker is not installed or the daemon is not running: {out}")
 
     try:
         cmd = "docker-compose version"
-        subprocess.check_output(cmd, stderr=subprocess.STDOUT, shell=True)
+        subprocess.check_output(cmd, stderr=subprocess.STDOUT, shell=True)  # nosec
     except subprocess.CalledProcessError as err:
         out = (err.output or b"").decode("utf-8")
         pytest.skip(f"docker-compose is not installed: {out}")

dvc/ui/pager.py

@@ -59,7 +59,7 @@ def find_pager():
     if not pager:
         pager = os.getenv(PAGER_ENV)
     if not pager:
-        if os.system(f"({DEFAULT_PAGER}) 2>{os.devnull}") != 0:
+        if os.system(f"({DEFAULT_PAGER}) 2>{os.devnull}") != 0:  # nosec B605
             logger.warning(
                 "Unable to find `less` in the PATH. Check out %s for more info.",
                 format_link("https://man.dvc.org/pipeline/show"),

dvc/version.py

@@ -1,7 +1,7 @@
 # pylint: disable=unused-import
 try:
-    from ._dvc_version import version as __version__
-    from ._dvc_version import version_tuple
+    from ._dvc_version import version as __version__  # type: ignore[import]
+    from ._dvc_version import version_tuple  # type: ignore[import]
 except ImportError:
     __version__ = "UNKNOWN"
     version_tuple = (0, 0, __version__)  # type: ignore[assignment]

pyproject.toml

@@ -257,9 +257,8 @@ ignored-argument-names = "_.*|args|kwargs"
 # external flake8 codes that should be preserved
 external = ["B301", "C901", "E302", "W601"]
 ignore = ["N818", "S101", "PT004", "PT007", "PT019", "SIM105", "SIM108", "SIM110", "SIM117", "TRY003", "TRY200", "TRY300", "TRY301", "PLR2004", "PLW2901", "RUF005"]
-select = ["F", "E", "W", "C90", "N", "UP", "YTT", "S", "BLE", "B", "A", "C4", "T10", "ISC", "ICN", "G", "INP", "PIE", "T20", "PT", "Q", "RET501", "RET504", "SIM", "TID", "TCH", "ARG", "PGH", "PLC", "PLE", "PLR", "PLW", "TRY", "RUF"]
+select = ["F", "E", "W", "C90", "N", "UP", "YTT", "S", "BLE", "B", "A", "C4", "T10", "EXE", "ISC", "ICN", "G", "INP", "PIE", "T20", "PT", "Q", "RET501", "RET504", "SIM", "TID", "TCH", "ARG", "PGH", "PLC", "PLE", "PLR", "PLW", "TRY", "RUF"]
 show-source = true
-target-version = "py38"
 
 [tool.ruff.flake8-pytest-style]
 fixture-parentheses = false
@@ -290,3 +289,7 @@ ignore-names = ["M", "SCM"]
 
 [tool.ruff.pylint]
 max-args = 10
+
+[tool.bandit]
+exclude_dirs = ["tests", "scripts"]
+skips = ["B101"]

tests/unit/remote/test_webhdfs.py

@@ -47,5 +47,5 @@ def test_verify_ssl(dvc, webhdfs_config, monkeypatch, mocker):
     del webhdfs_config["token"]
     fs = WebHDFSFileSystem(**webhdfs_config)
     # ssl verify can't be set until after the file system is instantiated
-    fs.fs
+    assert fs.fs
     assert mock_session.verify == ssl_verify