From 140ce1a593e5c0c0f107cf9f44fb6639efa15252 Mon Sep 17 00:00:00 2001 From: maziggy Date: Mon, 10 Aug 2026 16:13:59 +0200 Subject: [PATCH] Give the variant-group backfill query the nosec marker that applies The line carried "# noqa: S608", which is ruff's flake8-bandit code -- but S is not in ruff's select list in pyproject.toml, so ruff never ran that rule and the marker suppressed nothing. Bandit itself only honours "# nosec", so the query went on being reported as B608 while the line read as already handled. The finding is a false positive. The only interpolated fragments are source_expr and model_expr, assigned just above from a two-branch is_sqlite() check where both branches are string literals; no caller value reaches the string. They are JSON expressions rather than values, so a bind parameter cannot express them. Replaces the inert marker with "# nosec B608", matching the convention already used across the test suite, and moves the reasoning into a comment above the statement. Bandit's medium+ count drops to 16, none of them B608. --- backend/app/core/database.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/backend/app/core/database.py b/backend/app/core/database.py index 81545016d..859ef77ac 100644 --- a/backend/app/core/database.py +++ b/backend/app/core/database.py @@ -4412,10 +4412,14 @@ async def _migrate_backfill_variant_groups(conn) -> None: model_expr = "file_metadata::jsonb->>'sliced_for_model'" async with conn.begin_nested(): + # nosec B608 — the only interpolated fragments are the two dialect + # literals assigned directly above; both branches are constants and no + # caller value reaches this string. They are JSON *expressions*, not + # values, so a bind parameter cannot express them. rows = ( await conn.execute( text( - f"SELECT id, {source_expr} AS source_id, {model_expr} AS model " # noqa: S608 — dialect literals + f"SELECT id, {source_expr} AS source_id, {model_expr} AS model " # nosec B608 "FROM library_files " f"WHERE {source_expr} IS NOT NULL AND {model_expr} IS NOT NULL " "AND variant_group_id IS NULL AND deleted_at IS NULL "