Skip to content

fix(security): suppress bandit FPs to unblock security-scan CI on PR #93 - #112

Open
github-actions[bot] wants to merge 1 commit into
chore/a2a-prod-rollout-prepfrom
claude-auto-fix-ci-chore/a2a-prod-rollout-prep-30053331579
Open

fix(security): suppress bandit FPs to unblock security-scan CI on PR #93#112
github-actions[bot] wants to merge 1 commit into
chore/a2a-prod-rollout-prepfrom
claude-auto-fix-ci-chore/a2a-prod-rollout-prep-30053331579

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Root cause

The security-scan CI job runs bandit -r . --skip B101 -f txt (no || true), which exits code 1 whenever any issue is found. PR #93 (chore/a2a-prod-rollout-prep) had 53 unannotated Bandit findings across the orchestrator service — the last one visible in the truncated CI log was B105 (hardcoded password string) in tests/test_residual_authz.py:34.

Fix

Cherry-port of commit 77eb667 (fix(security): harden subprocess/bind/try-pass/tmp + justify test FPs — part 3) from the sec-83-bandit fix branch, with:

  • Resolved database.py merge conflict (our branch has a newer schema)
  • Added @pytest.mark.asyncio to TestUpdateColumnAllowlist (needed for test-backend not to regress)

Changes by Bandit rule

Rule Where Action
B105 hardcoded secret test_residual_authz.py, test_auth_authz.py, test_hierarchy_ws_authz.py # nosec B105 — test-only JWT fixture
B404/B603/B607 subprocess claude_code_wrapper.py, claude_sdk_manager.py, git_workflow_manager.py # nosec — shell=False, static argv
B104 bind 0.0.0.0 simple_main.py, main_with_hierarchy.py, container_manager.py env-gate via HOST env var + # nosec B104
B108 hardcoded /tmp model_configuration.py replaced with tempfile.gettempdir() + FUZEAGENT_KEY_DIR env
B108 tmpfs/test paths sandbox_manager.py, test_claude_code_wrapper.py # nosec B108 — container mount point / test literal
B110 bare except container_manager.py, main.py narrowed to except Exception + debug logging
B608 SQL injection database.py moved column allowlist validation before DB connection (fail-fast)

Closes the security-scan failure on PR #93.

Refs #93

🤖 Generated with Claude Code

… — port to PR #93

Cherry-port of commit 77eb667 (from the sec-83-bandit fix branch) onto the
chore/a2a-prod-rollout-prep PR branch, with resolved database.py conflict and
the @pytest.mark.asyncio decorator added for the new allowlist test class.

Root cause of security-scan failure: bandit -r . --skip B101 exits 1 whenever
it finds any issue. The test_residual_authz.py file (and several others) had
unannotated false-positives that triggered B105/B404/B603/B607/B104/B108/B110.

Changes applied:
- B105: add # nosec B105 to JWT_SECRET test fixtures in test_residual_authz.py,
  test_auth_authz.py, and test_hierarchy_ws_authz.py
- B404/B603/B607: annotate subprocess imports + calls (shell=False, static argv)
  in claude_code_wrapper.py, claude_sdk_manager.py, git_workflow_manager.py
- B104: env-gate uvicorn host in simple_main.py + main_with_hierarchy.py;
  annotate Docker port-map string in container_manager.py
- B108: replace hard-coded /tmp in model_configuration.py with tempfile.gettempdir()
  + FUZEAGENT_KEY_DIR env; annotate sandbox tmpfs mount + test path
- B110: replace bare except/pass with narrowed excepts + debug logging in
  container_manager.py and main.py websocket broadcast paths
- database.py: move column allowlist validation before DB connection (fail-fast)
- Add tests/test_database_update_allowlist.py with @pytest.mark.asyncio decorator

Fixes security-scan CI failure on PR #93.
Refs #93

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@github-actions
github-actions Bot requested a review from izzywdev as a code owner July 23, 2026 23:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants