Skip to content

Allow # nosec on the preceeding line #469

@thanatos

Description

@thanatos

Is your feature request related to a problem? Please describe.
I've been asked/required to elaborate on the rationale for any # nosec comments in the codebase. (This is a good idea/practice, IMO.) However, generally, there's little room in the margin on the line on which a # nosec currently needs to be placed.

Describe the solution you'd like
I'd love it if I could place the # nosec above the offending line. E.g.,

Currently,

        subprocess.check_call(['gzip', '-r', dst])  # nosec <little room>

This could be:

        # nosec: `dst` here come from <source>, which we know to be safe
        # due to <rationale.>
        subprocess.check_call(['gzip', '-r', dst])

Describe alternatives you've considered
We can just do both, e.g.,

        # nosec: `dst` here come from <source>, which we know to be safe
        # due to <rationale.>
        subprocess.check_call(['gzip', '-r', dst])  # nosec

(Note that the line itself is also flagged.) My co-worker would like to be able to grep out all nosecs and hopefully find all/any that lack rationale. E.g., with /# nosec *$/. However, that would catch the above incorrectly: the rationale is just slightly detached from the notice, so these show up as false positives.

Additional context
Keep in mind #418, which I'd also like to see. 😄

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions