Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

False-positive B107:hardcoded_password_default with None parameter #1227

Open
fmigneault opened this issue Jan 28, 2025 · 0 comments
Open

False-positive B107:hardcoded_password_default with None parameter #1227

fmigneault opened this issue Jan 28, 2025 · 0 comments
Labels
bug Something isn't working

Comments

@fmigneault
Copy link

fmigneault commented Jan 28, 2025

Describe the bug

Given a function such as:

def __init__(self, auth_scheme, auth_token=None, auth_username=None, auth_password=None, auth_link=None, **kwargs):
    ...

Bandit will flag it as

>> Issue: [B107:hardcoded_password_default] Possible hardcoded password: 'None'
   Severity: Low   Confidence: Medium
   CWE: CWE-259 (https://cwe.mitre.org/data/definitions/259.html)
   More Info: https://bandit.readthedocs.io/en/1.8.1/plugins/b107_hardcoded_password_default.html

However, this is clearly not correct, as there is no value applied (None).

This occurs only starting from https://github.com/PyCQA/bandit/releases/tag/1.8.1. All corresponding code works without issue and is not flagged by bandit in earlier versions.

Reproduction steps

1. Define a code as shown above.
2. Run with `bandit<=1.8.0`, everything works.
3. Run with `bandit>=1.8.1`, false positives are raised.

Expected behavior

Explicit None are not considered as hardcoded password strings.

Using None is very typical when defining keyword arguments where passwords might not be mandatory.

Bandit version

1.8.1

Python version

3.10

Additional context

No response

@fmigneault fmigneault added the bug Something isn't working label Jan 28, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant