PyCQA / PyCQA/bandit

False positive on token_fail_reason

Open
#843 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
835
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

Up until this latest release, our bandit workflows have delivered passing results without issue. With our latest commit, 1.7.3 was installed and our unit testing failed with the following:

Issue: [B105:hardcoded_password_string] Possible hardcoded password: 'Unexpected API response received'
   Severity: Low   Confidence: Medium
   CWE: CWE-[25](https://github.com/CrowdStrike/falconpy/runs/5401017629?check_suite_focus=true#step:5:25)9 (https://cwe.mitre.org/data/definitions/259.html)
   Location: src/falconpy/oauth2.py:157:41
   More Info: https://bandit.readthedocs.io/en/1.7.3/plugins/b105_hardcoded_password_string.html
156	                returned = generate_error_result("Unexpected API response received", 403)
157	                self.token_fail_reason = "Unexpected API response received"
158	                self.token_status = 403

Impacted code block

if isinstance(returned, dict):
    self.token_status = returned["status_code"]
    if self.token_status == 201:
        self.token_expiration = returned["body"]["expires_in"]
        self.token_time = time.time()
        self.token_value = returned["body"]["access_token"]
        self.token_fail_reason = None
        # unrelated code continues...
else:
    returned = generate_error_result("Unexpected API response received", 403)
    self.token_fail_reason = "Unexpected API response received"
    self.token_status = 403
Reproduction steps
Started occurring with the 1.7.3 install. (I've confirmed it's not an issue in 1.7.0 - 1.7.2)
Expected behavior

I don't believe there is a problem with the code above.

Bandit version

1.7.3 (Default)

Python version

3.10 (Default)

Additional context

Appears to be similar to issue #842.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by inspecting the B105 hardcoded_password_string plugin and comparing its behavior between Bandit 1.7.2 and 1.7.3. Reproduce the report using the shown src/falconpy/oauth2.py token_fail_reason assignment, then add or update a regression test so this message is no longer reported as a hardcoded password.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.