From d1cb81976cba7fbd3b13525a26b163cc42f029a7 Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <hugovk@users.noreply.github.com>
Date: Tue, 13 Dec 2022 18:32:55 +0200
Subject: [PATCH] Run Bandit on CI via pre-commit

---
 .pre-commit-config.yaml | 9 ++++++++-
 src/PIL/ImageShow.py    | 2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 8d133b18d..609352f22 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -3,7 +3,7 @@ repos:
     rev: 22.12.0
     hooks:
       - id: black
-        args: ["--target-version", "py37"]
+        args: [--target-version=py37]
         # Only .py files, until https://github.com/psf/black/issues/402 resolved
         files: \.py$
         types: []
@@ -13,6 +13,13 @@ repos:
     hooks:
       - id: isort
 
+  - repo: https://github.com/PyCQA/bandit
+    rev: 1.7.4
+    hooks:
+    - id: bandit
+      args: [--severity-level=high]
+      files: ^src/
+
   - repo: https://github.com/asottile/yesqa
     rev: v1.4.0
     hooks:
diff --git a/src/PIL/ImageShow.py b/src/PIL/ImageShow.py
index 76f42a307..9d5224588 100644
--- a/src/PIL/ImageShow.py
+++ b/src/PIL/ImageShow.py
@@ -125,7 +125,7 @@ class Viewer:
                 path = options.pop("file")
             else:
                 raise TypeError("Missing required argument: 'path'")
-        os.system(self.get_command(path, **options))
+        os.system(self.get_command(path, **options))  # nosec
         return 1