Fix blacklist filtering

Blacklist is now available as multiple plugin codes instead of
single B001. Filtering should work on each of those code separately.
This fixes both include and exclude.

Change-Id: I1426eacfe7d441431b52ff330066413ac0f01d5f
Closes-bug: 1576321

bandit/core/test_set.py

@@ -42,13 +42,30 @@ class BanditTestSet():
         inc = set(profile.get('include', []))
         exc = set(profile.get('exclude', []))
 
+        all_blacklist_tests = set()
+        for _node, tests in six.iteritems(extman.blacklist):
+            all_blacklist_tests.update(t['id'] for t in tests)
+
+        # this block is purely for backwards compatibility, the rules are as
+        # follows:
+        # B001,B401 means B401
+        # B401 means B401
+        # B001 means all blacklist tests
+        if 'B001' in inc:
+            if not inc.intersection(all_blacklist_tests):
+                inc.update(all_blacklist_tests)
+            inc.discard('B001')
+        if 'B001' in exc:
+            if not exc.intersection(all_blacklist_tests):
+                exc.update(all_blacklist_tests)
+            exc.discard('B001')
+
         if inc:
             filtered = inc
         else:
             filtered = set(extman.plugins_by_id.keys())
             filtered.update(extman.builtin)
-            for node, tests in six.iteritems(extman.blacklist):
+            filtered.update(all_blacklist_tests)
-                filtered.update(t['id'] for t in tests)
         return filtered - exc
 
     def _load_builtins(self, filtering, profile):
@@ -59,27 +76,25 @@ class BanditTestSet():
                 self.name = name
                 self.plugin = plugin
 
-        results = []
+        extman = extension_loader.MANAGER
+        blacklist = profile.get('blacklist')
+        if not blacklist:  # not overriden by legacy data
+            blacklist = {}
+            for node, tests in six.iteritems(extman.blacklist):
+                values = [t for t in tests if t['id'] in filtering]
+                if values:
+                    blacklist[node] = values
 
-        if 'B001' in filtering:
+        if not blacklist:
-            extman = extension_loader.MANAGER
+            return []
-            blacklist = profile.get('blacklist')
-            if not blacklist:  # not overridden by legacy data
-                blacklist = {}
-                for node, tests in six.iteritems(extman.blacklist):
-                    values = [t for t in tests if t['id'] in filtering]
-                    if values:
-                        blacklist[node] = values
 
-            # this dresses up the blacklist to look like a plugin, but
+        # this dresses up the blacklist to look like a plugin, but
-            # the '_checks' data comes from the blacklist information.
+        # the '_checks' data comes from the blacklist information.
-            # the '_config' is the filtered blacklist data set.
+        # the '_config' is the filtered blacklist data set.
-            setattr(blacklisting.blacklist, "_test_id", 'B001')
+        setattr(blacklisting.blacklist, "_test_id", 'B001')
-            setattr(blacklisting.blacklist, "_checks", blacklist.keys())
+        setattr(blacklisting.blacklist, "_checks", blacklist.keys())
-            setattr(blacklisting.blacklist, "_config", blacklist)
+        setattr(blacklisting.blacklist, "_config", blacklist)
-            results.append(Wrapper('blacklist', blacklisting.blacklist))
+        return [Wrapper('blacklist', blacklisting.blacklist)]
-
-        return results
 
     def _load_tests(self, config, plugins):
         '''Builds a dict mapping tests to node types.'''

tests/unit/core/test_test_set.py

@@ -101,6 +101,13 @@ class BanditTestSetTests(testtools.TestCase):
         self.assertEqual(len(ts.get_tests('ImportFrom')), 0)
         self.assertEqual(len(ts.get_tests('Call')), 0)
 
+    def test_profile_exclude_builtin_blacklist_specific(self):
+        profile = {'exclude': ['B302', 'B401']}
+        ts = test_set.BanditTestSet(self.config, profile)
+        self.assertEqual(len(ts.get_tests('Import')), 0)
+        self.assertEqual(len(ts.get_tests('ImportFrom')), 0)
+        self.assertEqual(len(ts.get_tests('Call')), 0)
+
     def test_profile_filter_blacklist_none(self):
         ts = test_set.BanditTestSet(self.config)
         blacklist = ts.get_tests('Import')[0]