PyCQA / bandit

Bandit is a tool designed to find common security issues in Python code.
https://bandit.readthedocs.io
Apache License 2.0
6.51k stars 612 forks source link

Handle variant in how policy is passed in paramiko #1078

Closed ericwb closed 11 months ago

ericwb commented 11 months ago

Paramiko permits various ways of importing the missing host key policy. It allows paramiko.client.AutoAddPolicy or paramiko.AutoAddPolicy. The later isn't being handled in Bandit.

This change adds news tests and modifies the plugin to inspect the AST to determine whether the argument is an Attribute, Name, or Call.

Fixes #1077