0

I have installed bandit with pip but when I run bandit --help in the command line, I get the following error:

Traceback (most recent call last):
  File "/home/alipqb/.local/share/virtualenvs/django_with_pytest-FUuC6zdm/bin/bandit", line 5, in <module>
    from bandit.cli.main import main
  File "/home/alipqb/.local/share/virtualenvs/django_with_pytest-FUuC6zdm/lib/python3.8/site-packages/bandit/__init__.py", line 19, in <module>
    from bandit.core import config  # noqa
  File "/home/alipqb/.local/share/virtualenvs/django_with_pytest-FUuC6zdm/lib/python3.8/site-packages/bandit/core/__init__.py", line 17, in <module>
    from bandit.core import config  # noqa
  File "/home/alipqb/.local/share/virtualenvs/django_with_pytest-FUuC6zdm/lib/python3.8/site-packages/bandit/core/config.py", line 12, in <module>
    from bandit.core import extension_loader
  File "/home/alipqb/.local/share/virtualenvs/django_with_pytest-FUuC6zdm/lib/python3.8/site-packages/bandit/core/extension_loader.py", line 109, in <module>
    MANAGER = Manager()
  File "/home/alipqb/.local/share/virtualenvs/django_with_pytest-FUuC6zdm/lib/python3.8/site-packages/bandit/core/extension_loader.py", line 27, in __init__
    self.load_blacklists(blacklists_namespace)
  File "/home/alipqb/.local/share/virtualenvs/django_with_pytest-FUuC6zdm/lib/python3.8/site-packages/bandit/core/extension_loader.py", line 78, in load_blacklists
    for val in six.itervalues(self.blacklist):
AttributeError: module 'six' has no attribute 'itervalues'

Also I should mention that bandit is in the path and there is no problem with it.

What should I do?

Alipqb
  • 101
  • 4
  • 7
  • As the error message indicates, `bandit` is trying to use a function from `six` that isn't there in your installed copy. So, first question: What version of the `six` module do you actually have installed? – Charles Duffy Jul 08 '21 at 18:43
  • The version is six==1.16.0 – Alipqb Jul 08 '21 at 18:45
  • Can you confirm that that's the version that's _actually in use_? (The concern here is that there could be more than one copy in the PYTHONPATH). – Charles Duffy Jul 08 '21 at 18:46
  • 1
    One way to find out with certainty would be to run `python -i /path/to/bandit --help`, and then when it drops you to a Python interpreter after the error, `import sys`, and then `print(sys.modules['six'].__file__)`; then you can inspect the file it names and determine if it contains what you expect. (It _should_ be a match for https://github.com/benjaminp/six/blob/1.16.0/six.py, but the error indicates that it probably isn't). – Charles Duffy Jul 08 '21 at 18:47
  • This is my `pipenv graph` output: ``` bandit==1.7.0 - GitPython [required: >=1.0.1, installed: 3.1.18] - gitdb [required: >=4.0.1,<5, installed: 4.0.7] - smmap [required: >=3.0.1,<5, installed: 4.0.0] - PyYAML [required: >=5.3.1, installed: 5.4.1] - six [required: >=1.10.0, installed: 1.16.0] - stevedore [required: >=1.20.0, installed: 3.3.0] - pbr [required: >=2.0.0,!=2.1.0, installed: 5.6.0] ``` – Alipqb Jul 08 '21 at 18:48
  • The goal here is to double-check pip's work. Don't just trust what it tells you; verify against what's actually in-memory after the failure. – Charles Duffy Jul 08 '21 at 18:49
  • 1
    Thanks, the problem was solved. I opened the output of `print(sys.modules['six'].__file__)` and checked it. It was totally empty. I removed it and reinstalled it. and It worked. Can I ask why this happens? I mean empty modules! – Alipqb Jul 08 '21 at 19:01
  • I'd need a [mre] to speak to how it happened. It's not unheard of to have failure modes where a system powering off at the wrong time can leave a file's creation ready to be committed to the filesystem but not the actual data, but that's very much dependent on a specific sequence of events. – Charles Duffy Jul 08 '21 at 19:04
  • This problem was related to installation and I don't think I can reproduce the scenario. But thanks a lot for your help. It was a new way for me to debug an error. I learned a lot. – Alipqb Jul 08 '21 at 19:53

0 Answers0