Allow custom plugins outside Bandit source/library paths

[ericwb]

See https://twitter.com/presidentbeef/status/785270001250934784.

Method for adding custom Bandit plugins (https://github.com/openstack/bandit#extending-bandit) requires modification to Bandit source or library paths.

Can we support loading of custom plugins from other locations?

[bcaller]

It doesn't require "modification to Bandit source or library paths".

Make a new package.

If you have a plugin in file my_bandit_plugins/bad_stuff.py with function warn_on_using_bad_stuff make a setup.py like:

from setuptools import find_packages, setup

setup(
    name='...',
    version='...',
    description='...',
    url='....',
    packages=['my_bandit_plugins'],
    author='...',
    install_requires=[
        'bandit',
    ],
    entry_points={
        'bandit.plugins': [
            'stuff = my_bandit_plugins.bad_stuff:warn_on_using_bad_stuff',
        ],
    }
)

and pip install it and bandit will automatically pick it up due to the entry_points above.

[ehooo]

@ericwb could you take a look the pull request #340 ? what do you think about?

[ehooo]

@bcaller the improve I do will not require to reinstall the Bandit.
@lukehinds any idea about if this issue will be on the next version?

[lukehinds]

@ehooo , will take a look.

[whitespots]

Will be a lot more easy to develop a custom plugin with this feature of topicstarter

[ericwb]

Creating 3rd party plugins is already possible via Stevedore. One such example is https://github.com/microsoft/bandit-sarif-formatter