Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

#nosec directive not applied to entire expression split across multiple lines by Black formatter #1033

Open
pawin35 opened this issue Jun 16, 2023 · 0 comments
Labels
bug Something isn't working

Comments

@pawin35
Copy link

pawin35 commented Jun 16, 2023

Describe the bug

Description

I am encountering an issue when using the #nosec directive on an expression that has been split across multiple lines. The problem is present when I use the Bandit tool in combination with the Black code formatter.

Reproduction steps

1. Here is the original code snippet:

import random
import math

test_list_with_a_very_long_name = [1, 6, 3, 10, 21, 31, 50, 49, 20, 100]
a = random.sample(test_list_with_a_very_long_name, math.floor(random.randint() * len(test_list_with_a_very_long_name)))  # nosec
print(a)
  1. Running Bandit on this code doesn't report any security issues due to the #nosec directive.
  2. When the Black formatter is applied, it breaks the line into smaller constituents due to its length, as such:
import random
import math

test_list_with_a_very_long_name = [1, 6, 3, 10, 21, 31, 50, 49, 20, 100]
a = random.sample(
    test_list_with_a_very_long_name,
    math.floor(random.randint() * len(test_list_with_a_very_long_name)),
)  # nosec
print(a)
  1. After applying Black, running Bandit reports an issue with the random function, even though the #nosec directive is present.
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/0.0.0/blacklists/blacklist_calls.html#b311-random
   Location: res1x.py:7:15
6           test_list_with_a_very_long_name,
7           math.floor(random.randint() * len(test_list_with_a_very_long_name)),
8       )  # nosec

Expected behavior

The #nosec directive should apply to the whole expression even when it is split into different lines due to the Black formatter's line length considerations.

Bandit version

1.7.5

Python version

3.10.6

@pawin35 pawin35 added the bug Something isn't working label Jun 16, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant