False nosec encountered warning
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 836
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
The warning text "WARNING nosec encountered (X), but no failed test on line Y" incorrectly appears in some cases. It may also appear more than once for the same line number and test under specific circumstances.
Reproduction steps
Consider this base code:
import shlex
import subprocess
proc = subprocess.Popen(args=shlex.split("ffmpeg -i file.mp3"))
Since there are 2 function calls on this line of code, there are 2 calls to run_tests in bandit/core/issue.py.
If we include a nosec comment specifying the correct test to ignore (i.e. B603):
import shlex
import subprocess
proc = subprocess.Popen(args=shlex.split("ffmpeg -i file.mp3")) # nosec: B603
the following warning text displays:
WARNING nosec encountered (B603), but no failed test on line 3
If we include a nosec comment specifying something else (e.g. B602):
import shlex
import subprocess
proc = subprocess.Popen(args=shlex.split("ffmpeg -i file.mp3")) # nosec: B602
the following warning text displays:
WARNING nosec encountered (B602), but no failed test on line 3
WARNING nosec encountered (B602), but no failed test on line 3
Expected behavior
- The warning text should not appear more than once for the same line number and test.
- The warning should only appear if there is no failed test on the line for the specified test only.
Bandit version
1.7.5 (Default)
Python version
3.10
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in bandit/core/issue.py, focusing on the run_tests calls and nosec warning handling described by the reproduction. Reproduce the B603 and B602 examples, then check the existing test coverage around these warnings. Done means each warning is emitted at most once per line and test, and only when that specified test has no failure on the line.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100