-
-
Notifications
You must be signed in to change notification settings - Fork 717
Open
Labels
bugSomething isn't workingSomething isn't working
Description
Describe the bug
bandit 1.6.2 reports a false negative using python 3.8 versus 3.7 for hardcoded credentials.
Possibly a duplicate of #551
To Reproduce
Given an example file foo.py like:
def fooBar(password):
if password == "root":
print("OK, logged in")Expected behavior
Bandit should have the same output as it has with 3.7:
/ # bandit --version
bandit 1.6.2
python version = 3.8.2 (default, Mar 24 2020, 02:56:01) [GCC 9.2.0]
/ # bandit -r /src
main] INFO profile include tests: None
[main] INFO profile exclude tests: None
[main] INFO cli include tests: None
[main] INFO cli exclude tests: None
[main] INFO running on Python 3.8.2
Run started:2020-04-27 08:09:13.240911
Test results:
No issues identified.
Code scanned:
Total lines of code: 3
Total lines skipped (#nosec): 0
Run metrics:
Total issues (by severity):
Undefined: 0.0
Low: 0.0
Medium: 0.0
High: 0.0
Total issues (by confidence):
Undefined: 0.0
Low: 0.0
Medium: 0.0
High: 0.0
Files skipped (0):
versus
/ # bandit --version
bandit 1.6.2
python version = 3.7.7 (default, Apr 24 2020, 22:09:29) [GCC 9.2.0]
/ # bandit -r /src
[main] INFO profile include tests: None
[main] INFO profile exclude tests: None
[main] INFO cli include tests: None
[main] INFO cli exclude tests: None
[main] INFO running on Python 3.7.7
Run started:2020-04-27 08:07:46.261926
Test results:
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: 'root'
Severity: Low Confidence: Medium
Location: /src/foo.py:2
More Info: https://bandit.readthedocs.io/en/latest/plugins/b105_hardcoded_password_string.html
1 def fooBar(password):
2 if password == "root":
3 print("OK, logged in")
--------------------------------------------------
Code scanned:
Total lines of code: 3
Total lines skipped (#nosec): 0
Run metrics:
Total issues (by severity):
Undefined: 0.0
Low: 1.0
Medium: 0.0
High: 0.0
Total issues (by confidence):
Undefined: 0.0
Low: 0.0
Medium: 1.0
High: 0.0
Files skipped (0):
Bandit version
bandit 1.6.2
python version = 3.8.2 (default, Mar 24 2020, 02:56:01) [GCC 9.2.0]
guilatrova, leoahnn, silby, HarrySky and yogendra1911
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working