PyCQA / PyCQA/bandit

#nosec BXXX does not contribute to `Total lines skipped (#nosec)`

Open
#1,205 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

When running code that has a nosec line that specifes a test these lines are not counted in the "Total lines skipped" metric in the summary

Reproduction steps
1. Create foo.py with this content:


table = "my_table"
query = "SELECT * FROM {} WHERE True".format(table)  # nosec B608


2. Run `bandit foo.py` from the shell
3. At the end of the run observe the summary and notice the `Total lines skipped` is 0

❯ bandit blah.py
[main]  INFO    profile include tests: None
[main]  INFO    profile exclude tests: None
[main]  INFO    cli include tests: None
[main]  INFO    cli exclude tests: None
[main]  INFO    running on Python 3.12.7
Run started:2024-11-21 17:22:51.993562

Test results:
        No issues identified.

Code scanned:
        Total lines of code: 2
        Total lines skipped (#nosec): 0

Run metrics:
        Total issues (by severity):
                Undefined: 0
                Low: 0
                Medium: 0
                High: 0
        Total issues (by confidence):
                Undefined: 0
                Low: 0
                Medium: 0
                High: 0
Files skipped (0):
Expected behavior

The Total lines skipped should be 1 just like when you use a bare #nosec

Bandit version

1.7.10 (Default)

Python version

3.12

Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Run the reported bandit foo.py reproduction first, then trace the CLI summary's Total lines skipped (#nosec) calculation and how a test-specific #nosec is recorded. Done means a regression check demonstrates that the B608 line is counted as 1 while preserving bare #nosec behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.