PyCQA / PyCQA/bandit

Suppressing B105 on a multiline dict assignment

Open
#1,352 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

When suppressing a (correct) error B105 (hardcoded_password_string) in a multiline dict assignment, it raises a warning about nosec encountered (B105), but no failed test on other lines, even though there is no such comment on the line

Reproduction steps
1. Create the file `test.py`:


DATABASES: "DatabaseGlobalConfigDict" = {
    "default": {
        "ENGINE": "django.db.backends.postgresql",
        "NAME": "name",
        "USER": "user",
        "PASSWORD": "password",  # nosec B105
        "HOST": "localhost",
        "OPTIONS": {
            "pool": {
                "min_size": 4,
                "max_size": 10,
            },
        },
    },
}


2. run `bandit temp.py`
Expected behavior

No warning and no error should be reported. The actual output is as follows:

[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.14.2
[tester]	WARNING	nosec encountered (B105), but no failed test on line 1
[tester]	WARNING	nosec encountered (B105), but no failed test on line 2
[tester]	WARNING	nosec encountered (B105), but no failed test on line 3
[tester]	WARNING	nosec encountered (B105), but no failed test on line 4
[tester]	WARNING	nosec encountered (B105), but no failed test on line 5
[tester]	WARNING	nosec encountered (B105), but no failed test on line 7
[tester]	WARNING	nosec encountered (B105), but no failed test on line 8
[tester]	WARNING	nosec encountered (B105), but no failed test on line 3
[tester]	WARNING	nosec encountered (B105), but no failed test on line 4
[tester]	WARNING	nosec encountered (B105), but no failed test on line 5
[tester]	WARNING	nosec encountered (B105), but no failed test on line 6
[tester]	WARNING	nosec encountered (B105), but no failed test on line 7
Run started:2026-01-24 22:48:09.148111+00:00

Test results:
	No issues identified.

Code scanned:
	Total lines of code: 15
	Total lines skipped (#nosec): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 0
		Medium: 0
		High: 0
	Total issues (by confidence):
		Undefined: 0
		Low: 0
		Medium: 0
		High: 0
Files skipped (0):

It would be expected that those spurious warnings wouldn't appear

Bandit version

1.9.1 (Default)

Python version

3.14 (Default)

Additional context

Actually, the version of bandit I am running is 1.9.3 but it isn't available in the dropdown when creating an issue...

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with the multiline dictionary in test.py and run Bandit as shown. Trace how the nosec B105 suppression is handled across the dictionary's lines; done means the valid suppression produces no spurious warnings and the scan reports no issues.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.