search

PyCQA / bandit

Bandit is a tool designed to find common security issues in Python code.
https://bandit.readthedocs.io
Apache License 2.0
6.39k stars 604 forks source link

OSSFuzz Integration #1079

Closed capuanob closed 9 months ago

capuanob commented 10 months ago

Good evening,

I am looking to integrate bandit into OSSFuzz. If you are not familiar with OSSFuzz, it is Google's platform for continuous fuzzing of open-source software. In order to get the most out of this program, it would be greatly beneficial to be able to merge in my fuzz harness and build scripts into the upstream repository and contribute bug fixes if they come up. Is this something that you would support me putting the effort into?

Thank you in advance!

ericwb commented 9 months ago

I suggest any OSSFuzz code kept in a separate repo from Bandit. I don't know the exact details of this integration, but I don't see much overlap in these two tools. That being said, Bandit has a plugin model using Stevedore.