Skip to content

1.7.3 breaks on hashlib.sha256() with Python 3.9, works ok with hashlib.new("sha256") #838

@schlenk

Description

@schlenk

Describe the bug

Using Python 3.9 and bandit 1.7.3 the code throws a traceback when trying to parse:

hashlib.sha256()

It works correctly with Python 3.8.

[tester]        ERROR   Bandit internal error running: hashlib on file src/oic\oic\__init__.py at line 1329: 'name'Traceback (most recent call last):
  File "c:\users\me\.virtualenvs\pyoidc_offical-l5_fcrz7\lib\site-packages\bandit\core\tester.py", line 53, in run_tests
    result = test(context)
  File "c:\users\me\.virtualenvs\pyoidc_offical-l5_fcrz7\lib\site-packages\bandit\plugins\hashlib_insecure_functions.py", line 115, in hashlib
    return _hashlib_func(context)
  File "c:\users\me\.virtualenvs\pyoidc_offical-l5_fcrz7\lib\site-packages\bandit\plugins\hashlib_insecure_functions.py", line 57, in _hashlib_func
    name = args[0] if args else keywords["name"]
KeyError: 'name'

Reproduction steps

  1. Install Python 3.9
  2. Install bandit 1.7.3
  3. Create trivial file:
import hashlib
hashlib.sha256()
  1. Run bandit and get a traceback

Expected behavior

No traceback. It should work with both hashlib.sha256 and hashlib.new("sha256").

Bandit version

1.7.3 (Default)

Python version

3.9

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions