Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

S604 shows warning for any type, not just True #8310

Closed
adamhl8 opened this issue Oct 28, 2023 · 1 comment · Fixed by #8359
Closed

S604 shows warning for any type, not just True #8310

adamhl8 opened this issue Oct 28, 2023 · 1 comment · Fixed by #8359
Assignees
Labels
documentation Improvements or additions to documentation

Comments

@adamhl8
Copy link

adamhl8 commented Oct 28, 2023

Say you have something like this:

def do_stuff(shell):
    pass

Calling this function with any argument for shell will show S604, not just True as the warning/documentation implies.

do_stuff(shell="bash")
# S604 Function call with `shell=True` parameter identified, security issue
do_stuff(shell=123)
# S604 Function call with `shell=True` parameter identified, security issue
@charliermarsh
Copy link
Member

I believe this is as intended and matches Bandit's behavior -- I think the documentation is the problem.

@charliermarsh charliermarsh added the documentation Improvements or additions to documentation label Oct 28, 2023
@charliermarsh charliermarsh self-assigned this Oct 30, 2023
charliermarsh added a commit that referenced this issue Oct 30, 2023
…cs (#8359)

## Summary

If the value of `shell` wasn't literally `True`, we now show a message
describing it as truthy, rather than the (misleading) `shell=True`
literal in the diagnostic.

Closes #8310.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
documentation Improvements or additions to documentation
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants