Failed detection in injection_sql plugin
Open
Nobody has claimed this yet.
bug
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 835
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
injection_sql.py plugin fails to check hardcoded_sql_expressions on certain test cases.
To Reproduce
Steps to reproduce the behavior:
- Create
test.pyfile with content:
"SELECT a " + "FROM " + vuln
- Run bandit:
bandit test.py - There are no detected issues in the console output
Expected behavior
The above test.py file should generate hardcoded_sql_expressions issue.
Bandit version
1.6.2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading injection_sql.py and reproducing the issue with the test.py snippet using bandit test.py. Trace how hardcoded_sql_expressions handles the concatenated string, then add or update coverage for this case. Done means Bandit reports the expected hardcoded_sql_expressions issue for the reproduction.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100