You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I am encountering an issue when using the #nosec directive on an expression that has been split across multiple lines. The problem is present when I use the Bandit tool in combination with the Black code formatter.
Reproduction steps
1. Here is the original code snippet:
import random
import math
test_list_with_a_very_long_name = [1, 6, 3, 10, 21, 31, 50, 49, 20, 100]
a = random.sample(test_list_with_a_very_long_name, math.floor(random.randint() * len(test_list_with_a_very_long_name))) # nosec
print(a)
Running Bandit on this code doesn't report any security issues due to the #nosec directive.
When the Black formatter is applied, it breaks the line into smaller constituents due to its length, as such:
import random
import math
test_list_with_a_very_long_name = [1, 6, 3, 10, 21, 31, 50, 49, 20, 100]
a = random.sample(
test_list_with_a_very_long_name,
math.floor(random.randint() * len(test_list_with_a_very_long_name)),
) # nosec
print(a)
After applying Black, running Bandit reports an issue with the random function, even though the #nosec directive is present.
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
Severity: Low Confidence: High
CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
More Info: https://bandit.readthedocs.io/en/0.0.0/blacklists/blacklist_calls.html#b311-random
Location: res1x.py:7:15
6 test_list_with_a_very_long_name,
7 math.floor(random.randint() * len(test_list_with_a_very_long_name)),
8 ) # nosec
Expected behavior
The #nosec directive should apply to the whole expression even when it is split into different lines due to the Black formatter's line length considerations.
Bandit version
1.7.5
Python version
3.10.6
The text was updated successfully, but these errors were encountered:
Describe the bug
Description
I am encountering an issue when using the
#nosec
directive on an expression that has been split across multiple lines. The problem is present when I use the Bandit tool in combination with the Black code formatter.Reproduction steps
#nosec
directive.#nosec
directive is present.Expected behavior
The
#nosec
directive should apply to the whole expression even when it is split into different lines due to the Black formatter's line length considerations.Bandit version
1.7.5
Python version
3.10.6
The text was updated successfully, but these errors were encountered: