mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-09-30 03:01:21 +02:00
maziggy
140ce1a593
The line carried "# noqa: S608", which is ruff's flake8-bandit code -- but S is not in ruff's select list in pyproject.toml, so ruff never ran that rule and the marker suppressed nothing. Bandit itself only honours "# nosec", so the query went on being reported as B608 while the line read as already handled. The finding is a false positive. The only interpolated fragments are source_expr and model_expr, assigned just above from a two-branch is_sqlite() check where both branches are string literals; no caller value reaches the string. They are JSON expressions rather than values, so a bind parameter cannot express them. Replaces the inert marker with "# nosec B608", matching the convention already used across the test suite, and moves the reasoning into a comment above the statement. Bandit's medium+ count drops to 16, none of them B608.