multiline docstrings exclusion
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 836
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
the following line can't be excluded using # nosec as mentioned in the documentation
assert yaml.load("""{ # nosec
}""") == []
this is happening only with the recent version of bandit 1.7.3, the previous version 1.7.2 works perfectly.
I explained the issue using the documentation example. In "reality" I have long sql queries for which I can't tell the lib to be excluded .
Reproduction steps
1. bandit -q -r .
Expected behavior
no errors
Bandit version
1.7.3 (Default)
Python version
3.8.4
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Run bandit -q -r . against the provided multiline yaml.load example under Bandit 1.7.3, then compare the result with 1.7.2. Trace how # nosec is handled inside multiline strings and add regression coverage for this reproduction. Done means the documented exclusion suppresses the finding without affecting normal scanning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100