search

pyupio / safety

Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.
https://safetycli.com/product/safety-cli
MIT License
1.66k stars 141 forks source link

Output includes ANSI escape sequences when inappropriate #408

Closed stevecj closed 1 year ago

stevecj commented 1 year ago

Description

Printing full report output in a CI test run prints ANSI codes, even though the environment does not indicate that ANSI color is appropriate. I also tried piping the output through less, and commands should, by default, not include ANSI codes in output when piped (stdout is not a terminal). I tried running with TERM set to "dumb" instead of "xterm-256color" and with CLICOLOR set to "0". None of that convinced safety to not print the ANSI escape sequences.

stevecj commented 1 year ago

I finally realized that I could get a list of options for the check subcommand with safety check --help and was able to figure out by trial and error that --output text will eliminate the ansi codes from the output. It would still be nice if safety would automatically not include escape codes in cases where commandline apps are supposed to know to omit them.

yeisonvargasf commented 1 year ago

Hi @stevecj, we are sorry for your bad experience with the ANSI color and the documentation. We have tried to link our documentation in all the possible places; maybe we may add the docs link in Safety CI too.

You can find all the available outputs in the docs portal: https://docs.pyup.io/docs/safety-20-configuration-outputs.

We updated the docs portal to include the No Styling option. Safety reads an environment variable called SAFETY_COLOR, but in 2.2.0 and below, there is a bug reading that ENV var; The fix for the bug is in PR #412, so SAFETY_COLOR will be usable in the next release.

I agree with your recommendation, Safety should try to detect when the style is inappropriate, I'm going to keep this open.

yeisonvargasf commented 1 year ago

I'm closing this issue because the latest Safety version supports the SAFETY_COLOR var. Trying to detect when using the style or text automatically will need another issue and more details.