Allow outputting the report in multiple formats

[stefanfoulis]

Is your feature request related to a problem? Please describe.
In some cases, it is desirable to have the report in multiple different formats.

Describe the solution you'd like
Allow outputting the report in multiple formats with just one run.

Describe alternatives you've considered
Running the command multiple times for the different report formats can take very long on large codebases.

[ecp4224]

I have a need for this feature, glancing at the CLI package would simply invoking

b_mgr.output_results(args.context_lines,
                         sev_level,
                         conf_level,
                         args.output_file,
                         args.output_format,
                         args.msg_template)

in a for loop, changing the args.output_format parameter with some form of list that's passed as an argument work? Maybe args.output_format could always be treated as a comma separated list? That way people currently doing something like -f csv won't have to change anything, but people also have the option to do -f csv,screen,xml.

[sblancov]

Please, if this works, merge please, it is tremendously useful in CI.

I want to see the log and get HTML reports at the same time.

The horrible workaround is executing this tool twice :(

[asdf8601]

Any update on this? I could check on the PR that it's almost done! 👍

[kobiche]

Any update? I find this extremely useful

[stijn-techwolf]

Any update? I find this extremely useful as well

[srgoni]

in a for loop, changing the args.output_format parameter with some form of list that's passed as an argument work? Maybe args.output_format could always be treated as a comma separated list? That way people currently doing something like -f csv won't have to change anything, but people also have the option to do -f csv,screen,xml.

That won't be enough, because you'd be overwriting the same file every time.

Other tools work around this by appending a format-specific suffix to the file name, or by accepting a comma-separated list of output file names.

Another way could be to add separate parameters for enabling/disabling logging the report to stdout.

[elazarcoh]

Created a small bandit plugin for this:
https://pypi.org/project/bandit-multi-format/
after installing, can be used with:

BANDIT_MULTI_FORMATS=txt,sarif,json bandit -f multi -r .
BANDIT_MULTI_FORMATS=txt,sarif,json BANDIT_MULTI_OUTPUT_DIR=./bandit_outputs bandit -f multi -r .