PyCQA / PyCQA/bandit

#nosec is not working for multiline assert.

Open
#623 5 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
835
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug
#nosec is not working for multiline assert.

To Reproduce
I have a multiline assert like the following:

assert 10<20, 'display a very' \
            'long multiline message' \
            'for this assert' #nosec

I have added #nosec to the above assert. When I run bandit -r, it does not exclude the error.

Expected behavior
Adding #nosec should exclude the error

Bandit version

bandit 1.6.2
  python version = 3.6.5 |Anaconda, Inc.| (default, Mar 29 2018, 13:32:41) [MSC v.1900 64 bit (AMD64)]

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the reported multiline assert with Bandit 1.6.2 and inspect how #nosec comments are associated with multiline assertions. Done means the shown trailing #nosec suppresses the reported error while ordinary #nosec behavior remains unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.