#nosec not working for multi-line strings in python 3.8 #658

Stannislav · 2020-12-07T14:43:15Z

The Problem

Starting python3.8 adding #nosec after a multi-line string has no effect. This was not the case in python 3.6 (and I think also 3.7)

How to Reproduce

Prepare two sample python source files

success.py:

table = "my_table"
query = f"SELECT * FROM {table}"  # nosec

fail.py

table = "my_table"
query = f"""
SELECT *
FROM {table}
"""  # nosec

Set up `python3.6` and `python3.8` environments

$ python3.6 -m venv venv36
$ python3.8 -m venv venv38

Run bandit using `python3.6`

$ source ./venv36/bin/activate
$ pip install bandit==1.6.3

Run bandit on success.py -- no issues.

$ bandit success.py
[main]  INFO    profile include tests: None
[main]  INFO    profile exclude tests: None
[main]  INFO    cli include tests: None
[main]  INFO    cli exclude tests: None
[main]  INFO    running on Python 3.6.12
[node_visitor]  INFO    Unable to find qualified name for module: success.py
Run started:2020-12-07 14:35:50.699373

Test results:
        No issues identified.

Code scanned:
        Total lines of code: 2
        Total lines skipped (#nosec): 1

Run metrics:
        Total issues (by severity):
                Undefined: 0.0
                Low: 0.0
                Medium: 0.0
                High: 0.0
        Total issues (by confidence):
                Undefined: 0.0
                Low: 0.0
                Medium: 0.0
                High: 0.0
Files skipped (0):

Run bandit on fail.py -- no issues either.

$ bandit fail.py
[main]  INFO    profile include tests: None
[main]  INFO    profile exclude tests: None
[main]  INFO    cli include tests: None
[main]  INFO    cli exclude tests: None
[main]  INFO    running on Python 3.6.12
[node_visitor]  INFO    Unable to find qualified name for module: fail.py
Run started:2020-12-07 14:25:36.277457

Test results:
        No issues identified.

Code scanned:
        Total lines of code: 5
        Total lines skipped (#nosec): 1

Run metrics:
        Total issues (by severity):
                Undefined: 0.0
                Low: 0.0
                Medium: 0.0
                High: 0.0
        Total issues (by confidence):
                Undefined: 0.0
                Low: 0.0
                Medium: 0.0
                High: 0.0
Files skipped (0):
$ deactivate

Run bandit in `python3.8`

$ source ./venv38/bin/activate
$ pip install bandit==1.6.3

Run bandit on success.py -- no issues.

$ bandit success.py 
[main]  INFO    profile include tests: None
[main]  INFO    profile exclude tests: None
[main]  INFO    cli include tests: None
[main]  INFO    cli exclude tests: None
[main]  INFO    running on Python 3.8.6
[node_visitor]  INFO    Unable to find qualified name for module: success.py
Run started:2020-12-07 14:37:02.909155

Test results:
        No issues identified.

Code scanned:
        Total lines of code: 2
        Total lines skipped (#nosec): 1

Run metrics:
        Total issues (by severity):
                Undefined: 0.0
                Low: 0.0
                Medium: 0.0
                High: 0.0
        Total issues (by confidence):
                Undefined: 0.0
                Low: 0.0
                Medium: 0.0
                High: 0.0
Files skipped (0):

Run bandit on fail.py -- one issue is reported.

$ bandit fail.py           
[main]  INFO    profile include tests: None
[main]  INFO    profile exclude tests: None
[main]  INFO    cli include tests: None
[main]  INFO    cli exclude tests: None
[main]  INFO    running on Python 3.8.6
[node_visitor]  INFO    Unable to find qualified name for module: fail.py
Run started:2020-12-07 14:26:41.664117

Test results:
>> Issue: [B608:hardcoded_sql_expressions] Possible SQL injection vector through string-based query construction.
   Severity: Medium   Confidence: Low
   Location: fail.py:2
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b608_hardcoded_sql_expressions.html
1       table = "my_table"
2       query = f"""
3       SELECT *
4       FROM {table}
5       """  # nosec

--------------------------------------------------

Code scanned:
        Total lines of code: 5
        Total lines skipped (#nosec): 0

Run metrics:
        Total issues (by severity):
                Undefined: 0.0
                Low: 0.0
                Medium: 1.0
                High: 0.0
        Total issues (by confidence):
                Undefined: 0.0
                Low: 1.0
                Medium: 0.0
                High: 0.0
Files skipped (0):
$ deactivate

Expected Behaviour

The #nosec clause should work both in python3.6 and python3.8. In this concrete example bandit fail.py should not fail in python3.8.

Bandit Version

On python3.6:

$ bandit --version
bandit 1.6.3
  python version = 3.6.12 (default, Nov  6 2020, 13:08:49) [GCC Apple LLVM 12.0.0 (clang-1200.0.32.21)]

On python3.8

$ bandit --version
bandit 1.6.3
  python version = 3.8.6 (default, Nov  6 2020, 13:26:24) [Clang 12.0.0 (clang-1200.0.32.21)]

The text was updated successfully, but these errors were encountered:

PyCQA/bandit#658 The above bug currently makes Bandit report some security issues that are false positives because it ignores our # nosec comments. Signed-off-by: Jakob Sinclair <[email protected]>

In Python version 3.8, the #nosec stopped working, check it [here](PyCQA/bandit#658). For this reason, we'll use Python 3.7 until the problem is fixed

Peterl777 · 2021-09-16T07:40:53Z

Confirming it's also a problem on 3.9.7 on Windows

C:\test> bandit --version
bandit 1.7.0
  python version = 3.9.7 (tags/v3.9.7:1016ef3, Aug 30 2021, 20:19:38) [MSC v.1929 64 bit (AMD64)]

oliver-sanders · 2021-10-04T13:05:48Z

Confirmed with 3.8 & 3.9 on Linux.

It looks like the line number of the error is being reported as the first line of the multi line string (where we cannot put a nosec comment) whereas before it was the last line.

Using the report above as an example:

Test results:
>> Issue: [B608:hardcoded_sql_expressions] Possible SQL injection vector through string-based query construction.
   Severity: Medium   Confidence: Low
   Location: fail.py:2
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b608_hardcoded_sql_expressions.html
1       table = "my_table"
2       query = f"""
3       SELECT *
4       FROM {table}
5       """  # nosec

The error is reported on line 2:

Location: fail.py:2

ryan-gontarek · 2022-01-24T18:01:46Z

My workaround:

"""# nosec"""; query = f"""
SELECT *
FROM {table}
"""

waltertschwe · 2022-02-08T22:04:10Z

My workaround:

"""# nosec"""; query = f"""
SELECT *
FROM {table}
"""

very nice. you also don't need that comma.

"""# nosec"""
query = f""" 
select...
""""

works too.

CarliJoy · 2022-02-10T16:02:18Z

A black compatible workaround

        # fmt: off
        query = (  # nosec
            f"""
            SELECT something,
            WHERE foobar = {bar} 
            """
        )
        # fmt: on

Still please fix. Especially using black this can be a pain in the ass ;-)

DrakezulsMinimalism · 2022-02-28T16:28:08Z

I also just experienced this in my pipeline.
Checked with python:

3.7.12 working
3.8.10 not working
3.9.10 not working

michiel-nwa · 2022-03-04T09:40:01Z

I'm not able to get any of the mentioned workarounds to work. Only thing that worked for me for now was downgrading back to bandit 1.6.2.

kfrydel · 2023-03-03T07:49:26Z

I think this can be closed now. It is fixed by the linked pull request.

nevdelap · 2023-03-31T04:42:42Z

I have this problem with bandit 1.7.5 and Python 3.10.9. I'm using this version of the workaround.

                connection,
                sql=(  # nosec
                    f"""

kfrydel · 2023-03-31T06:19:39Z

Can you share the whole piece of code (or minimal example) for which the bandit does not behave as expected?

GeyseR · 2023-03-31T08:37:34Z

@nevdelap after switching to the latest bandit version I had to move SQL nosec comments to the end of multiline strings
before:

sql(
    f"""  # nosec
    some SQL query
    """,
)

after:

sql(
    f"""
    some SQL query
    """,  # nosec
)

nevdelap · 2023-03-31T09:11:33Z

Thanks @GeyseR. That works. All good.

rikkiprince · 2024-03-19T17:59:48Z

A black compatible workaround

        # fmt: off
        query = (  # nosec
            f"""
            SELECT something,
            WHERE foobar = {bar} 
            """
        )
        # fmt: on

Thank you so much @CarliJoy!

Stannislav mentioned this issue Dec 7, 2020

Fix bandit in python 3.8 BlueBrain/Search#184

Merged

ericwb added the bug Something isn't working label Dec 7, 2020

ericwb modified the milestones: Release 1.6.4, Release 2.0.0, Release 1.7.1 Dec 9, 2020

obi1kenobi mentioned this issue Jan 13, 2021

Allow microseconds in datetimes and allow identity-function parsing. kensho-technologies/graphql-compiler#991

Merged

franciscodua pushed a commit to codacy/codacy-bandit that referenced this issue Sep 7, 2021

fix: Downgrade python3 version CY-4843

55e204b

In Python version 3.8, the #nosec stopped working, check it [here](PyCQA/bandit#658). For this reason, we'll use Python 3.7 until the problem is fixed

franciscodua mentioned this issue Sep 7, 2021

fix: Downgrade python3 version CY-4843 codacy/codacy-bandit#48

Merged

oliver-sanders mentioned this issue Oct 4, 2021

Bandit cylc/cylc-flow#4405

Merged

GliderGeek mentioned this issue Nov 11, 2021

#nosec is not working for multiline assert. #623

Open

ericwb modified the milestones: Release 1.7.3, Near Future Feb 27, 2022

frenzymadness mentioned this issue Aug 10, 2022

Improve handling nosec for multi-line strings #915

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

#nosec not working for multi-line strings in python 3.8 #658

#nosec not working for multi-line strings in python 3.8 #658

Stannislav commented Dec 7, 2020 •

edited

Loading

Peterl777 commented Sep 16, 2021

oliver-sanders commented Oct 4, 2021 •

edited

Loading

ryan-gontarek commented Jan 24, 2022 •

edited

Loading

waltertschwe commented Feb 8, 2022 •

edited

Loading

CarliJoy commented Feb 10, 2022

DrakezulsMinimalism commented Feb 28, 2022

michiel-nwa commented Mar 4, 2022

kfrydel commented Mar 3, 2023

nevdelap commented Mar 31, 2023

kfrydel commented Mar 31, 2023

GeyseR commented Mar 31, 2023

nevdelap commented Mar 31, 2023 via email •

edited

Loading

rikkiprince commented Mar 19, 2024 •

edited

Loading

#nosec not working for multi-line strings in python 3.8 #658

#nosec not working for multi-line strings in python 3.8 #658

Comments

Stannislav commented Dec 7, 2020 • edited Loading

The Problem

How to Reproduce

Prepare two sample python source files

Set up python3.6 and python3.8 environments

Run bandit using python3.6

Run bandit in python3.8

Expected Behaviour

Bandit Version

Peterl777 commented Sep 16, 2021

oliver-sanders commented Oct 4, 2021 • edited Loading

ryan-gontarek commented Jan 24, 2022 • edited Loading

waltertschwe commented Feb 8, 2022 • edited Loading

CarliJoy commented Feb 10, 2022

DrakezulsMinimalism commented Feb 28, 2022

michiel-nwa commented Mar 4, 2022

kfrydel commented Mar 3, 2023

nevdelap commented Mar 31, 2023

kfrydel commented Mar 31, 2023

GeyseR commented Mar 31, 2023

nevdelap commented Mar 31, 2023 via email • edited Loading

rikkiprince commented Mar 19, 2024 • edited Loading

Stannislav commented Dec 7, 2020 •

edited

Loading

Set up `python3.6` and `python3.8` environments

Run bandit using `python3.6`

Run bandit in `python3.8`

oliver-sanders commented Oct 4, 2021 •

edited

Loading

ryan-gontarek commented Jan 24, 2022 •

edited

Loading

waltertschwe commented Feb 8, 2022 •

edited

Loading

nevdelap commented Mar 31, 2023 via email •

edited

Loading

rikkiprince commented Mar 19, 2024 •

edited

Loading