False positive for B105 / Possible hardcoded password
Open
Nobody has claimed this yet.
bug
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 835
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
A false positive is produced for an url string that is spread over two lines despite the use of the suppression "# nosec".
REQUEST_TOKEN_URL = "https://api.twitter.com/oauth/request_token?\
oauth_callback=oob&x_auth_access_type=write" # nosec
Reproduction steps
1. Use above snippet in your code
2. Run bandit on the source.
Expected behavior
There should be no violation reported in the bandit report.
Bandit version
1.7.4 (Default)
Python version
3.11.2 (Default)
Additional context
None
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the B105 check and Bandit's handling of # nosec comments for Python string literals split across lines. Reproduce the two-line REQUEST_TOKEN_URL example with Bandit 1.7.4, then verify the report contains no violation when the suppression is present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100