Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

#nosec directive not applied to entire expression split across multiple lines by Black formatter #1033

Open
pawin35 opened this issue Jun 16, 2023 · 0 comments
Labels
bug Something isn't working

Comments

@pawin35
Copy link

pawin35 commented Jun 16, 2023

Describe the bug

Description

I am encountering an issue when using the #nosec directive on an expression that has been split across multiple lines. The problem is present when I use the Bandit tool in combination with the Black code formatter.

Reproduction steps

1. Here is the original code snippet:

import random
import math

test_list_with_a_very_long_name = [1, 6, 3, 10, 21, 31, 50, 49, 20, 100]
a = random.sample(test_list_with_a_very_long_name, math.floor(random.randint() * len(test_list_with_a_very_long_name)))  # nosec
print(a)
  1. Running Bandit on this code doesn't report any security issues due to the #nosec directive.
  2. When the Black formatter is applied, it breaks the line into smaller constituents due to its length, as such:
import random
import math

test_list_with_a_very_long_name = [1, 6, 3, 10, 21, 31, 50, 49, 20, 100]
a = random.sample(
    test_list_with_a_very_long_name,
    math.floor(random.randint() * len(test_list_with_a_very_long_name)),
)  # nosec
print(a)
  1. After applying Black, running Bandit reports an issue with the random function, even though the #nosec directive is present.
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/0.0.0/blacklists/blacklist_calls.html#b311-random
   Location: res1x.py:7:15
6           test_list_with_a_very_long_name,
7           math.floor(random.randint() * len(test_list_with_a_very_long_name)),
8       )  # nosec

Expected behavior

The #nosec directive should apply to the whole expression even when it is split into different lines due to the Black formatter's line length considerations.

Bandit version

1.7.5

Python version

3.10.6

@pawin35 pawin35 added the bug Something isn't working label Jun 16, 2023
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant