From 54408d616064a16b97b2e4521d86f9c367d0b3c0 Mon Sep 17 00:00:00 2001 From: PedroHMCosme Date: Tue, 22 Sep 2026 15:59:36 -0300 Subject: [PATCH] fix(gateway): suppress bandit B608 false positive in update_write_status schema/table are allowlist-validated via _validate_identifier() before interpolation (see docstring above), not a real SQL injection vector. The existing '# noqa: S608' only silences ruff; bandit runs as its own CI step and needs its own '# nosec B608' suppression syntax. --- ingestor/io/data_sink.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ingestor/io/data_sink.py b/ingestor/io/data_sink.py index 290f0e4..c5806bc 100644 --- a/ingestor/io/data_sink.py +++ b/ingestor/io/data_sink.py @@ -54,7 +54,7 @@ class DataSink: # schema/table are allowlist-validated identifiers above; status/timestamp/model_id # are bound params below, never interpolated — not a real injection vector. stmt = text( - f'UPDATE {schema}.{table} SET write_status = :status ' # noqa: S608 + f'UPDATE {schema}.{table} SET write_status = :status ' # noqa: S608 # nosec B608 'WHERE timestamp = :timestamp AND model_id = :model_id' ) params = {