PyCQA / PyCQA/bandit

False negative for hardcoded credentials (B105) using python 3.8

Open
#605 0 comments 6 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug
bandit 1.6.2 reports a false negative using python 3.8 versus 3.7 for hardcoded credentials.

Possibly a duplicate of #551

To Reproduce
Given an example file foo.py like:

def fooBar(password):
    if password == "root":
        print("OK, logged in")

Expected behavior
Bandit should have the same output as it has with 3.7:

/ # bandit --version
bandit 1.6.2
  python version = 3.8.2 (default, Mar 24 2020, 02:56:01) [GCC 9.2.0]
/ # bandit -r /src
main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.8.2
Run started:2020-04-27 08:09:13.240911

Test results:
	No issues identified.

Code scanned:
	Total lines of code: 3
	Total lines skipped (#nosec): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0.0
		Low: 0.0
		Medium: 0.0
		High: 0.0
	Total issues (by confidence):
		Undefined: 0.0
		Low: 0.0
		Medium: 0.0
		High: 0.0
Files skipped (0):

versus

/ # bandit --version
bandit 1.6.2
  python version = 3.7.7 (default, Apr 24 2020, 22:09:29) [GCC 9.2.0]
/ # bandit -r /src
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.7.7
Run started:2020-04-27 08:07:46.261926

Test results:
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: 'root'
   Severity: Low   Confidence: Medium
   Location: /src/foo.py:2
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b105_hardcoded_password_string.html
1	def fooBar(password):
2	    if password == "root":
3	        print("OK, logged in")

--------------------------------------------------

Code scanned:
	Total lines of code: 3
	Total lines skipped (#nosec): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0.0
		Low: 1.0
		Medium: 0.0
		High: 0.0
	Total issues (by confidence):
		Undefined: 0.0
		Low: 0.0
		Medium: 1.0
		High: 0.0
Files skipped (0):

Bandit version

bandit 1.6.2
  python version = 3.8.2 (default, Mar 24 2020, 02:56:01) [GCC 9.2.0]

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the foo.py reproduction and run the shown bandit -r command under Python 3.7 and 3.8. Trace the B105 hardcoded_password_string check and compare why the same password comparison produces different results; done means the Python 3.8 run reports the same finding as Python 3.7.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.