[Python] Detect usage of a (vulnerable) function in a imported module?

I would like to be able to detect if a (vulnerable) function is used in our code. This so that we can sometimes implement a waiver for using vulnerable dependencies (let's not go into a discussion on if we should do that or not).

I have been looking at bandit (https://pypi.org/project/bandit/) to implement for proofing that vulnerable functions from dependencies are not actually used within our code.

This seems to work OK when creating custom tests and implementing them through entry_points installing them as a custom package. But when testing out if it can detect the usage of a function in a module used by my code it fails (as far as I can see this is the expected behaviour so no comments on bandit or anything).

Question would be if I can use bandit (or some other tool?) to detect the usage of a specific function of a specific module even if it is used within a function of a different module? Usecase here would be other public dependencies using the function, or even a module created within the company that uses it but isn't being actively maintained or scanned.

Using bandit I created the following test:

import bandit
from bandit.core import issue
from bandit.core import test_properties as test

@test.checks("Call")
@test.test_id("B999")
def prohibit_requests_get(context):
if "requests.get" in context.call_function_name_qual:
return bandit.Issue(
severity=bandit.HIGH,
confidence=bandit.HIGH,
text="No don't use requests.get"
)



And I created a test module more_test.py:

import requests

def go():
r = requests.get('https://google.com')
print(r.status_code)


And then I have test.py that I run bandit on:

from more_test.more_test import go

go()


And when I run bandit test.py it shows no errors.

Continue reading...