mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-08-11 00:30:12 -04:00
140ce1a593
The line carried "# noqa: S608", which is ruff's flake8-bandit code -- but S is not in ruff's select list in pyproject.toml, so ruff never ran that rule and the marker suppressed nothing. Bandit itself only honours "# nosec", so the query went on being reported as B608 while the line read as already handled. The finding is a false positive. The only interpolated fragments are source_expr and model_expr, assigned just above from a two-branch is_sqlite() check where both branches are string literals; no caller value reaches the string. They are JSON expressions rather than values, so a bind parameter cannot express them. Replaces the inert marker with "# nosec B608", matching the convention already used across the test suite, and moves the reasoning into a comment above the statement. Bandit's medium+ count drops to 16, none of them B608. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| asyncio_handlers.py | ||
| auth.py | ||
| catalog_defaults.py | ||
| compat.py | ||
| config.py | ||
| database.py | ||
| db_dialect.py | ||
| encryption.py | ||
| local_config.py | ||
| logging_filters.py | ||
| oidc_env.py | ||
| paths.py | ||
| permissions.py | ||
| tasks.py | ||
| trace.py | ||
| websocket.py | ||