Fix #1204: Correct #nosec handling for f-strings and multi-line statements #1313
+23
−2
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
This pull request addresses Issue #1204 in Bandit, where # nosec BXXX comments were not correctly recognized on f-strings or multi-line statements.
Problem:
The existing get_nosec() function in utils.py only checked line numbers (context["linerange"]) to determine if a # nosec comment was present.
This approach caused false positives: Bandit incorrectly raised warnings for code lines that had # nosec when the comment was part of a multi-line f-string or expression.
Specific rule IDs like B607, B602 in # nosec BXXX comments were not properly parsed.
Fix:
Impact:
Testing:
pytest -k nosec