Skip to content

False Negatives in B105/B106/B107 Hardcoded Password Detection #1383

@tacu22

Description

@tacu22

Describe the bug

The current implementations of Bandit's B105 (Hardcoded Password String), B106 (Hardcoded Password Function Arguments), and B107 (Hardcoded Password Default Values) have some false negatives. These rules rely on rigid regular expressions for identifier matching and incomplete AST traversal for comparison operations. Consequently, hardcoded credentials are missed when used with common naming conventions (e.g., camelCase, api_key) or accessed via dictionary subscripts (e.g., data['password']).

For example

import pymysql
from genai import configure

class ConfigLoader:
    def __init__(self, data):
        self.data = data

    def authenticate_user(self):
        # FAILS
        # The rule expects ast.Name (e.g., 'password') or ast.Attribute (e.g., 'obj.password').
        # It misses dictionary access like data['password'].
        if self.data['password'] == 'hardcoded_secret_123':
            return True
        return False

    def load_credentials(self):
        # FAILS
        # 'DATABASEPASSWORD' does not match ^password$ or _password_.
        DATABASEPASSWORD = "password123"
        
        # FAILS: 'api_key' is not in the RE_WORDS list (password, secret, token, etc.).
        # Common credential identifiers like 'api_key', 'API_KEY)' are ignored.
        configure(api_key="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")

Reproduction steps

bandit -r  the_code_above.py

Expected behavior

3 alarms on these hardcoded cases

Bandit version

1.9.1 (Default)

Python version

3.14 (Default)

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions