False negative for hardcoded credentials (B105) using python 3.8
Open
Nobody has claimed this yet.
bug
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 836
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
bandit 1.6.2 reports a false negative using python 3.8 versus 3.7 for hardcoded credentials.
Possibly a duplicate of #551
To Reproduce
Given an example file foo.py like:
def fooBar(password):
if password == "root":
print("OK, logged in")
Expected behavior
Bandit should have the same output as it has with 3.7:
/ # bandit --version
bandit 1.6.2
python version = 3.8.2 (default, Mar 24 2020, 02:56:01) [GCC 9.2.0]
/ # bandit -r /src
main] INFO profile include tests: None
[main] INFO profile exclude tests: None
[main] INFO cli include tests: None
[main] INFO cli exclude tests: None
[main] INFO running on Python 3.8.2
Run started:2020-04-27 08:09:13.240911
Test results:
No issues identified.
Code scanned:
Total lines of code: 3
Total lines skipped (#nosec): 0
Run metrics:
Total issues (by severity):
Undefined: 0.0
Low: 0.0
Medium: 0.0
High: 0.0
Total issues (by confidence):
Undefined: 0.0
Low: 0.0
Medium: 0.0
High: 0.0
Files skipped (0):
versus
/ # bandit --version
bandit 1.6.2
python version = 3.7.7 (default, Apr 24 2020, 22:09:29) [GCC 9.2.0]
/ # bandit -r /src
[main] INFO profile include tests: None
[main] INFO profile exclude tests: None
[main] INFO cli include tests: None
[main] INFO cli exclude tests: None
[main] INFO running on Python 3.7.7
Run started:2020-04-27 08:07:46.261926
Test results:
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: 'root'
Severity: Low Confidence: Medium
Location: /src/foo.py:2
More Info: https://bandit.readthedocs.io/en/latest/plugins/b105_hardcoded_password_string.html
1 def fooBar(password):
2 if password == "root":
3 print("OK, logged in")
--------------------------------------------------
Code scanned:
Total lines of code: 3
Total lines skipped (#nosec): 0
Run metrics:
Total issues (by severity):
Undefined: 0.0
Low: 1.0
Medium: 0.0
High: 0.0
Total issues (by confidence):
Undefined: 0.0
Low: 0.0
Medium: 1.0
High: 0.0
Files skipped (0):
Bandit version
bandit 1.6.2
python version = 3.8.2 (default, Mar 24 2020, 02:56:01) [GCC 9.2.0]
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the foo.py reproduction and run the shown bandit -r command under Python 3.7 and 3.8. Trace the B105 hardcoded_password_string check and compare why the same password comparison produces different results; done means the Python 3.8 run reports the same finding as Python 3.7.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100