IndexError: list index out of range

[kamathe]

Bandit version

(bandit) [root@test BD]# bandit --version
bandit 1.6.2
python version = 2.7.5 (default, Jun 11 2019, 12:19:05) [GCC 4.8.5 20150623 (Red Hat 4.8.5-36)]
(bandit) [root@test BD]#

Actual error

ERROR	Bandit internal error running: weak_cryptographic_key on file ./ansible/lib/ansible/modules/crypto/openssl_privatekey.py at line 521: list index out of rangeTraceback (most recent call last):
  File "/BD/bandit/lib/python2.7/site-packages/bandit/core/tester.py", line 62, in run_tests
    result = test(context, test._config)
  File "/BD/bandit/lib/python2.7/site-packages/bandit/plugins/weak_cryptographic_key.py", line 139, in weak_cryptographic_key
    return (_weak_crypto_key_size_cryptography_io(context, config) or
  File "/BD/bandit/lib/python2.7/site-packages/bandit/plugins/weak_cryptographic_key.py", line 115, in _weak_crypto_key_size_cryptography_io
    context.call_args[arg_position[key_type]])
IndexError: list index out of range

[sonrohan]

Can you print out the output of key_type before this line? https://github.com/PyCQA/bandit/blob/master/bandit/plugins/weak_cryptographic_key.py#L115

[kamathe]

@sonrohan Check highlighted text below

(bandit) [root@test BD]# bandit ansible/lib/ansible/modules/crypto/openssl_privatekey.py
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 2.7.5
**-----------------------------
key_type : EC
-----------------------------**
[tester]	ERROR	Bandit internal error running: weak_cryptographic_key on file ansible/lib/ansible/modules/crypto/openssl_privatekey.py at line 521: list index out of range
Traceback (most recent call last):
  File "/BD/bandit/lib/python2.7/site-packages/bandit/core/tester.py", line 62, in run_tests
    result = test(context, test._config)
  File "/BD/bandit/lib/python2.7/site-packages/bandit/plugins/weak_cryptographic_key.py", line 142, in weak_cryptographic_key
    return (_weak_crypto_key_size_cryptography_io(context, config) or
  File "/BD/bandit/lib/python2.7/site-packages/bandit/plugins/weak_cryptographic_key.py", line 118, in _weak_crypto_key_size_cryptography_io
    context.call_args[arg_position[key_type]])
IndexError: list index out of range

[amacfie]

Bandit assumes if your code calls this function you are supplying the positional argument curve. If not you get this error.

[szuliq]

Why does it need to be positional? It's perfectly valid Python code to supply it as keyword argument. Therefore I claim this is a bug in bandit, do you agree?

[ericwb]

This occurs when the keyword is a ast.Call in this case. Bandit cannot determine the value of any such call, so it should ignore, but not throw a traceback.

[ericwb]

An example which exhibits the problem:

ec.generate_private_key(
    curve=curves[self.curve]['create'](self.size),
    backend=backends.default_backend()
)