Plugin crashes are not propagated / communicated

[Stanislaw Pitucha]

This applies mostly to development, but may affect real run in some way too. On a clean tree:

tox -e py27
# passes
sed -i 's/bandit/hfuiahueiawu/' bandit/plugins/app_debug.py
tox -e py27
# fails with "testtools.matchers._impl.MismatchError: 15 != 0" - shouldn't "plugin's completely broken, ImportError" be visible instead?

This seems like some silent failures are possible.

[Tim Kelsey (tim-kelsey)]

I'm not quite sure I follow what you mean here, can you elaborate please?

[Stanislaw Pitucha (stanislaw-pitucha)]

Imagine a situation where bandit missed installing some dependency, or some installed dependency is broken. That may result in ImportError when loading the plugin, rather than some exception at plugin runtime.

Currently, from the tests it looks like that kind of error is not propagated properly. This test failed, because it found 0 errors where 15 were expected, and not explicitly because the plugin failed to initialize.

But silent failures are not good for users or developers. Users should get a clear error that plugins failed to load (likely critical, app-stopping error), while developers should get a fail-fast at the place of a problem to make debugging easier.

[Travis McPeak (travis-mcpeak)]

What's the status of this?

[Travis McPeak (travis-mcpeak)]

Ping...