Suppressing B105 on a multiline dict assignment
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 836
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
When suppressing a (correct) error B105 (hardcoded_password_string) in a multiline dict assignment, it raises a warning about nosec encountered (B105), but no failed test on other lines, even though there is no such comment on the line
Reproduction steps
1. Create the file `test.py`:
DATABASES: "DatabaseGlobalConfigDict" = {
"default": {
"ENGINE": "django.db.backends.postgresql",
"NAME": "name",
"USER": "user",
"PASSWORD": "password", # nosec B105
"HOST": "localhost",
"OPTIONS": {
"pool": {
"min_size": 4,
"max_size": 10,
},
},
},
}
2. run `bandit temp.py`
Expected behavior
No warning and no error should be reported. The actual output is as follows:
[main] INFO profile include tests: None
[main] INFO profile exclude tests: None
[main] INFO cli include tests: None
[main] INFO cli exclude tests: None
[main] INFO running on Python 3.14.2
[tester] WARNING nosec encountered (B105), but no failed test on line 1
[tester] WARNING nosec encountered (B105), but no failed test on line 2
[tester] WARNING nosec encountered (B105), but no failed test on line 3
[tester] WARNING nosec encountered (B105), but no failed test on line 4
[tester] WARNING nosec encountered (B105), but no failed test on line 5
[tester] WARNING nosec encountered (B105), but no failed test on line 7
[tester] WARNING nosec encountered (B105), but no failed test on line 8
[tester] WARNING nosec encountered (B105), but no failed test on line 3
[tester] WARNING nosec encountered (B105), but no failed test on line 4
[tester] WARNING nosec encountered (B105), but no failed test on line 5
[tester] WARNING nosec encountered (B105), but no failed test on line 6
[tester] WARNING nosec encountered (B105), but no failed test on line 7
Run started:2026-01-24 22:48:09.148111+00:00
Test results:
No issues identified.
Code scanned:
Total lines of code: 15
Total lines skipped (#nosec): 0
Run metrics:
Total issues (by severity):
Undefined: 0
Low: 0
Medium: 0
High: 0
Total issues (by confidence):
Undefined: 0
Low: 0
Medium: 0
High: 0
Files skipped (0):
It would be expected that those spurious warnings wouldn't appear
Bandit version
1.9.1 (Default)
Python version
3.14 (Default)
Additional context
Actually, the version of bandit I am running is 1.9.3 but it isn't available in the dropdown when creating an issue...
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with the multiline dictionary in test.py and run Bandit as shown. Trace how the nosec B105 suppression is handled across the dictionary's lines; done means the valid suppression produces no spurious warnings and the scan reports no issues.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100