add bandit to pre-commit

.pre-commit-config.yaml

@@ -1,8 +1,8 @@
 default_language_version:
   python: python3
 repos:
-  - repo: 'https://github.com/pre-commit/pre-commit-hooks'
-    rev: v4.0.1
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.3.0
     hooks:
       - id: check-added-large-files
       - id: check-case-conflict
@@ -17,8 +17,8 @@ repos:
       - id: mixed-line-ending
       - id: sort-simple-yaml
       - id: trailing-whitespace
-  - repo: 'https://github.com/pycqa/flake8'
-    rev: 4.0.1
+  - repo: https://github.com/pycqa/flake8
+    rev: 5.0.4
     hooks:
       - id: flake8
         args:
@@ -28,16 +28,16 @@ repos:
           - flake8-comprehensions
           - flake8-debugger
           - flake8-string-format
-  - repo: 'https://github.com/psf/black'
-    rev: 22.3.0
+  - repo: https://github.com/psf/black
+    rev: 22.8.0
     hooks:
       - id: black
-  - repo: 'https://github.com/PyCQA/isort'
+  - repo: https://github.com/PyCQA/isort
     rev: 5.10.1
     hooks:
       - id: isort
-  - repo: 'https://github.com/pre-commit/mirrors-mypy'
-    rev: v0.942
+  - repo: https://github.com/pre-commit/mirrors-mypy
+    rev: v0.981
     hooks:
       - id: mypy
         additional_dependencies:
@@ -54,7 +54,11 @@ repos:
         entry: pylint -v
         language: system
         types: [ python ]
-  # - repo: https://github.com/PyCQA/bandit
-  #   rev: '1.7.0'
-  #   hooks:
-  #     - id: bandit
+  - repo: https://github.com/PyCQA/bandit
+    rev: 1.7.4
+    hooks:
+      - id: bandit
+        exclude: tests/
+        args:
+          - -iii  # high level
+          - -lll  # high confidense

mlem/contrib/docker/context.py

@@ -93,7 +93,7 @@ def _new_whl(path):
         with tempfile.TemporaryDirectory() as whl_dir:
             subprocess.check_output(
                 f"pip wheel . --no-deps -w {whl_dir}",
-                shell=True,
+                shell=True,  # nosec: B602
                 cwd=mlem_src_path,
             )
             whl_path = glob.glob(os.path.join(whl_dir, "*.whl"))[0]

mlem/contrib/pip/base.py

@@ -103,7 +103,9 @@ def build_whl(self, path, target, target_fs):
         logger.debug("Building whl from %s...", path)
         with tempfile.TemporaryDirectory() as whl_dir:
             subprocess.check_output(
-                f"pip wheel . --no-deps -w {whl_dir}", shell=True, cwd=path
+                f"pip wheel . --no-deps -w {whl_dir}",
+                shell=True,  # nosec: B602
+                cwd=path,
             )
             whl_path = glob.glob(os.path.join(whl_dir, "*.whl"))[0]
             whl_name = os.path.basename(whl_path)

mlem/utils/templates.py

@@ -21,6 +21,7 @@ def generate(self, **additional):
         j2 = Environment(
             loader=FileSystemLoader([self.TEMPLATE_DIR] + self.templates_dir),
             undefined=StrictUndefined,
+            autoescape=True,
         )
         template = j2.get_template(self.TEMPLATE_FILE)
         args = self.prepare_dict()