Adding Bandit to pre-commit.

.pre-commit-config.yaml

@@ -29,3 +29,13 @@ repos:
     hooks:
       - id: mypy
         args: ["--install-types", "--non-interactive", "--ignore-missing-imports"]
+  - repo: https://github.com/PyCQA/bandit
+    rev: 1.7.10
+    hooks:
+    - id: bandit
+      args: [ "--skip", "B101" ]
+      exclude: |
+        (?x)^(
+            .*/.*_test\.py|
+            .*/.*test_.*\.py
+        )$

README.md

@@ -1,5 +1,7 @@
 # Auto-generated System Security Plan (SSP)
 
+[![security: bandit](https://img.shields.io/badge/security-bandit-yellow.svg)](https://github.com/PyCQA/bandit)
+
 <!--ts-->
    * [Auto-generated System Security Plan (SSP)](#auto-generated-system-security-plan-ssp)
       * [Overview](#overview)

pyproject.toml

@@ -35,6 +35,6 @@ sop = "tools.sop.sop:main"
 makessp = "tools.makessp.makessp:main"
 getconfig = "tools.helpers.config:check_config"
 
-[[tool.mypy.overrides]]
+[tool.mypy.overrides]
 module = "yaml"
 ignore_missing_imports = true

tools/helpers/config.py

@@ -20,7 +20,7 @@ def __init__(self):
         if self.configuration.exists():
             try:
                 with open(self.configuration, "r") as fp:
-                    self.config = yaml.load(fp, Loader=yaml.FullLoader)
+                    self.config = yaml.safe_load(fp)
             except IOError:
                 print(f"Error loading {self.configuration.as_posix}.")
         else:
@@ -32,7 +32,7 @@ def load_keys(self):
             key = self.default_keys.get(filename.name, filename.stem)
             self.config_files.append((filename.name, key))
             with open(filename, "r") as fp:
-                self.config[key] = yaml.load(fp, Loader=yaml.FullLoader)
+                self.config[key] = yaml.safe_load(fp)
 
     def check_config_values(self, file: str, key: str = "") -> str | dict:
         if key:

tools/helpers/secrender.py

@@ -102,7 +102,7 @@ def get_template(template_path: str) -> jinja2.Template:
     abs_path = os.path.abspath(template_path)
     template_dir, template_file = os.path.split(abs_path)
     template_loader = jinja2.FileSystemLoader(searchpath=template_dir)
-    template_env = jinja2.Environment(loader=template_loader)
+    template_env = jinja2.Environment(loader=template_loader, autoescape=True)
     template = template_env.get_template(template_file)
 
     return template

tools/helpers/ssptoolkit.py

@@ -167,7 +167,7 @@ def load_yaml_files(file_path: str | Path) -> dict:
     load_file = Path(file_path) if isinstance(file_path, str) else file_path
     try:
         with open(load_file, "r") as fp:
-            project = yaml.load(fp, Loader=yaml.FullLoader)
+            project = yaml.safe_load(fp)
             return project
     except FileNotFoundError:
         raise FileNotFoundError(