Erroneous "no test failure on line" warning from plugin alert nosec?
Open
Nobody has claimed this yet.
bug
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 836
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
It looks like bandit warns about "no test failure on line" for a nosec where there definitely would be a test failure without the nosec.
Reproduction steps
- I start with a line that does
foo = hashlib.md5(buffer.read()).digest(). bandit -llrightly complains about the use of MD5 with a B324 error from the hashlib plugin.- I add
#nosec B324like this:foo = hashlib.md5(buffer.read()).digest() # nosec B324 - Bandit now says
[tester] WARNING nosec encountered (B324), but no failed test on line 85
Seems a bit weird.
Expected behavior
Don't warn at me for this.
Bandit version
1.7.4 (Default)
Python version
3.9
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the warning with Bandit 1.7.4 using bandit -ll on the hashlib.md5(buffer.read()).digest() # nosec B324 example. Trace the nosec handling for the hashlib plugin and verify that a valid B324 suppression no longer produces the warning while the unsuppressed finding still appears.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100