From 78576c225cfd65838f3bc523afd072d17c72a760 Mon Sep 17 00:00:00 2001 From: Christian Manivong Date: Fri, 23 Oct 2026 08:33:25 +0200 Subject: [PATCH] fix: what bandit and the remaining lint rules found - nosec for the staging path on the device (B108); it is a mktemp template on the remote host, not a local temp file. - The wildcard listen addresses parsed from sockstat/netstat are named constants with a nosec (B104): reported data, never a bind. The output is unchanged. - ruff found nothing left after the mechanical pass. --- napalm_bsd/base.py | 3 ++- napalm_bsd/parse.py | 7 ++++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/napalm_bsd/base.py b/napalm_bsd/base.py index e9e9e8c..89f9967 100644 --- a/napalm_bsd/base.py +++ b/napalm_bsd/base.py @@ -55,7 +55,8 @@ _PRIVILEGED_STDIN = ( #: Stages content without privilege: a fresh ``mktemp`` file only the login user #: may read, never a fixed name another user could create first. Prints its path. -_STAGE_TEMPLATE = "/tmp/napalm-bsd-stage.XXXXXX" +#: The path is on the device, not a local temp file. +_STAGE_TEMPLATE = "/tmp/napalm-bsd-stage.XXXXXX" # nosec B108 _STAGE_PREFIX = _STAGE_TEMPLATE[: -len("XXXXXX")] _STAGE = ( f"umask 077 && t=$(mktemp {_STAGE_TEMPLATE}) && " diff --git a/napalm_bsd/parse.py b/napalm_bsd/parse.py index a8968a3..4f93e70 100644 --- a/napalm_bsd/parse.py +++ b/napalm_bsd/parse.py @@ -259,6 +259,11 @@ def boottime(text: str) -> int | None: return int(match[1]) if match else None +#: The wildcard addresses a socket listens on: reported as data, never bound to. +_ANY_V4 = "0.0.0.0" # nosec B104 +_ANY_V6 = "::" + + def _socket( proto: str, local: str, family: str, process: str | None, pid: int | None ) -> dict[str, Any] | None: @@ -275,7 +280,7 @@ def _socket( return None address, _, zone = address.partition("%") if address == "*": - address = "0.0.0.0" if family == "4" else "::" + address = _ANY_V4 if family == "4" else _ANY_V6 return { "proto": proto, "address": address,