PyCQA / PyCQA/bandit

False nosec encountered warning

Open
#1,041 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

The warning text "WARNING nosec encountered (X), but no failed test on line Y" incorrectly appears in some cases. It may also appear more than once for the same line number and test under specific circumstances.

Reproduction steps

Consider this base code:

import shlex
import subprocess
proc = subprocess.Popen(args=shlex.split("ffmpeg -i file.mp3"))

Since there are 2 function calls on this line of code, there are 2 calls to run_tests in bandit/core/issue.py.

If we include a nosec comment specifying the correct test to ignore (i.e. B603):

import shlex
import subprocess
proc = subprocess.Popen(args=shlex.split("ffmpeg -i file.mp3"))  # nosec: B603

the following warning text displays:

WARNING	nosec encountered (B603), but no failed test on line 3

If we include a nosec comment specifying something else (e.g. B602):

import shlex
import subprocess
proc = subprocess.Popen(args=shlex.split("ffmpeg -i file.mp3"))  # nosec: B602

the following warning text displays:

WARNING	nosec encountered (B602), but no failed test on line 3
WARNING	nosec encountered (B602), but no failed test on line 3
Expected behavior
  • The warning text should not appear more than once for the same line number and test.
  • The warning should only appear if there is no failed test on the line for the specified test only.
Bandit version

1.7.5 (Default)

Python version

3.10

Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in bandit/core/issue.py, focusing on the run_tests calls and nosec warning handling described by the reproduction. Reproduce the B603 and B602 examples, then check the existing test coverage around these warnings. Done means each warning is emitted at most once per line and test, and only when that specified test has no failure on the line.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.