Tweaking logger

This moves the log format string to constants and removes it from
the config file (though it can still overridden if desired). This
forms part of the work to remove the config file entirely.

Additionally we now log out to stderr as per the linked blueprint

Implements: log-to-stderr

Change-Id: I09f352b41527c563a158fdcdbb1b7d5bc878c0da

bandit/bandit.py

@@ -46,14 +46,14 @@ def _init_logger(debug=False, log_format=None):
 
     if not log_format:
         # default log format
-        log_format_string = '[%(module)s]\t%(levelname)s\t%(message)s'
+        log_format_string = constants.log_format_string
     else:
         log_format_string = log_format
 
     logging.captureWarnings(True)
 
     logger.setLevel(log_level)
-    handler = logging.StreamHandler(sys.stdout)
+    handler = logging.StreamHandler(sys.stderr)
     handler.setFormatter(logging.Formatter(log_format_string))
     logger.addHandler(handler)
     logger.debug("logging initialized")

bandit/config/bandit.yaml

@@ -15,9 +15,6 @@ plugin_name_pattern: '*.py'
 #    MEDIUM: \033[93m
 #    HIGH: \033[91m
 
-# optional: log format string
-#log_format: "[%(module)s]\t%(levelname)s\t%(message)s"
-
 # globs of files which should be analyzed
 include:
     - '*.py'

bandit/core/constants.py

@@ -46,3 +46,6 @@ CONFIDENCE_DEFAULT = 'UNDEFINED'
 # have a variable we cannot determine if False.
 # See https://docs.python.org/2/library/stdtypes.html#truth-value-testing
 FALSE_VALUES = [None, False, 'False', 0, 0.0, 0j, '', (), [], {}]
+
+# override with "log_format" option in config file
+log_format_string = '[%(module)s]\t%(levelname)s\t%(message)s'