False negative: B104 misses `bind(("", port))` wildcard host
Open
Beginner friendly
Nobody has claimed this yet.
bug
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 836
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
B104 currently detects hardcoded wildcard binds when the host literal is "0.0.0.0", but it misses the equivalent Python socket form "".
In Python, socket.bind(("", port)) binds to all available interfaces (INADDR_ANY), which has the same exposure risk as "0.0.0.0".
Reproduction steps
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(("", 31137))
Expected behavior
Bandit should report B104: hardcoded_bind_all_interfaces for this case
Bandit version
1.9.1 (Default)
Python version
3.14 (Default)
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the B104 hardcoded_bind_all_interfaces check and the provided Python socket.bind(("", port)) reproduction. Trace how host literals are recognized, add coverage for the empty-string wildcard form, and run the relevant Bandit tests to confirm B104 is reported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100