From b306b646734d90f0d94be05ba98ce6823b1bc25c Mon Sep 17 00:00:00 2001
From: Christian Manivong <christian.manivong@gmail.com>
Date: Fri, 23 Oct 2026 08:39:32 +0200
Subject: [PATCH] fix: what bandit and the remaining lint rules found

- nosec for SHA512_password in the login payload (B105): it is a flag
  telling the gateway how Input_Passwd is encoded, not a password; a false
  positive.
- A failed login raises ConnectionException from the underlying error, so
  the cause stays attached.
- tests: pytest.raises instead of try / assert False / except, which
  python -O would have turned into tests that always pass.
---
 napalm_zyxel/zyxel_driver.py |  5 +++--
 tests/test_zyxel.py          | 20 ++++----------------
 2 files changed, 7 insertions(+), 18 deletions(-)

diff --git a/napalm_zyxel/zyxel_driver.py b/napalm_zyxel/zyxel_driver.py
index 5ae0460..96d6ff3 100644
--- a/napalm_zyxel/zyxel_driver.py
+++ b/napalm_zyxel/zyxel_driver.py
@@ -155,7 +155,8 @@ class ZyxelVMGDriver(ResidentialGatewayDriver):
             "Input_Account": self.username,
             "Input_Passwd": base64.b64encode(self.password.encode("ascii")).decode("ascii"),
             "RememberPassword": 0,
-            "SHA512_password": False,
+            # A flag telling the gateway how Input_Passwd is encoded, not a password.
+            "SHA512_password": False,  # nosec B105
         }
 
         enc_payload = crypto.encrypt_json(login_data)
@@ -169,7 +170,7 @@ class ZyxelVMGDriver(ResidentialGatewayDriver):
             resp.raise_for_status()
             result = crypto.decrypt_response(resp.json())
         except (requests.RequestException, json.JSONDecodeError, TypeError, KeyError) as e:
-            raise ConnectionException(f"Login failed at {self._base_url}: {e}")
+            raise ConnectionException(f"Login failed at {self._base_url}: {e}") from e
 
         if result.get("result") != "ZCFG_SUCCESS":
             raise ConnectionException(
diff --git a/tests/test_zyxel.py b/tests/test_zyxel.py
index eab9db1..965a3cf 100644
--- a/tests/test_zyxel.py
+++ b/tests/test_zyxel.py
@@ -146,11 +146,8 @@ class TestZyxelVMGDriver:
                 sess = MagicMock()
                 sess.get.side_effect = requests.ConnectionError("unreachable")
                 mock_session.return_value = sess
-                try:
+                with pytest.raises(ConnectionException):
                     self.driver.open()
-                    assert False, "Expected ConnectionException"
-                except ConnectionException:
-                    pass
 
     def test_close(self):
         self._setup_mocked_http()
@@ -298,19 +295,13 @@ class TestZyxelVMGDriver:
 
     def test_load_replace_candidate_raises(self):
         self._setup_mocked_http()
-        try:
+        with pytest.raises(NotImplementedError):
             self.driver.load_replace_candidate()
-            assert False, "Expected NotImplementedError"
-        except NotImplementedError:
-            pass
 
     def test_load_merge_candidate_raises(self):
         self._setup_mocked_http()
-        try:
+        with pytest.raises(NotImplementedError):
             self.driver.load_merge_candidate()
-            assert False, "Expected NotImplementedError"
-        except NotImplementedError:
-            pass
 
     def test_ping_not_implemented(self):
         self._setup_mocked_http()
@@ -325,11 +316,8 @@ class TestZyxelVMGDriver:
         from napalm.base.exceptions import ConnectionClosedException
 
         self.driver._session = None
-        try:
+        with pytest.raises(ConnectionClosedException):
             self.driver._dal_query("PINGTEST", {})
-            assert False, "Expected ConnectionClosedException"
-        except ConnectionClosedException:
-            pass
 
     def test_parse_port_forwards_dal(self):
         self._setup_mocked_http()