Implementation:NVIDIA DALI Bandit Config

Knowledge Sources	NVIDIA_DALI
Domains	Security, Configuration
Last Updated	2026-02-08 16:00 GMT

Overview

Bandit YAML configuration file that defines Python security linting rules, skipped checks, and plugin-specific settings for the NVIDIA DALI project.

Description

This configuration file controls the behavior of Bandit, a Python static analysis tool designed to find common security issues in Python code. The file is located at the repository root and applies to all Python source files scanned during DALI's CI/CD security checks.

The configuration enumerates all available Bandit test IDs (B101 through B703) as comments for reference, and then specifies a targeted skip list of five checks that are intentionally suppressed: B101 (assert_used), B110 (try_except_pass), B112 (try_except_continue), B303 (weak hash algorithms like MD5/SHA1), and B311 (use of the random module). These skips reflect pragmatic decisions for a data pipeline library where assertions are used extensively in testing, broad exception handling is common in plugin loading, and non-cryptographic hashing and random number generation are acceptable.

The remainder of the file provides detailed plugin-specific settings for several Bandit checks, including process execution functions (categorized into shell, no_shell, and subprocess groups), SSL/TLS bad protocol version lists, hardcoded temporary directories, and weak cryptographic key size thresholds. Each plugin section enumerates the exact function calls and parameters that trigger the respective security warnings.

Usage

This file is consumed automatically by the Bandit tool when invoked from the repository root. It is typically used in CI pipelines or local pre-commit hooks via a command such as bandit -r . -c bandit.yml to scan Python source for security vulnerabilities while respecting the project-specific exclusions.

Code Reference

Source Location

• Repository: NVIDIA_DALI
• File: bandit.yml
• Lines: 1-399

Signature

# Top-level structure
tests:              # (empty - all tests included by default)
skips: [B101, B110, B112, B303, B311]

# Plugin settings sections:
any_other_function_with_shell_equals_true:
  no_shell: [...]
  shell: [...]
  subprocess: [...]

assert_used:
  skips: []

hardcoded_tmp_directory:
  tmp_dirs: [/tmp, /var/tmp, /dev/shm]

ssl_with_bad_defaults:
  bad_protocol_versions: [...]

ssl_with_bad_version:
  bad_protocol_versions: [...]

weak_cryptographic_key:
  weak_key_size_dsa_high: 1024
  weak_key_size_rsa_high: 1024
  ...

Import

# Invoked via Bandit CLI
bandit -r . -c bandit.yml

I/O Contract

Inputs

Name	Type	Required	Description
tests	list	No	List of test IDs to include (empty means all)
skips	list	No	List of test IDs to exclude from scanning
Plugin settings	mapping	No	Per-plugin configuration overriding defaults

Outputs

Name	Type	Description
Bandit report	text	Security findings filtered according to the skips and plugin settings defined in this file

Usage Examples

Run Bandit with this config

# Run Bandit security scan on the entire DALI codebase
bandit -r dali/ -c bandit.yml

# Run with verbose output
bandit -r dali/ -c bandit.yml -v

# Run only specific tests (overriding config)
bandit -r dali/ -c bandit.yml -t B602,B603

Related Pages

• Environment:NVIDIA_DALI_CUDA_GPU_Environment