gitea_admin/sientia-dataops-opc-ingestor
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(gateway): suppress bandit B608 false positive in update_write_status

Browse Source 
schema/table are allowlist-validated via _validate_identifier() before
interpolation (see docstring above), not a real SQL injection vector.
The existing '# noqa: S608' only silences ruff; bandit runs as its own
CI step and needs its own '# nosec B608' suppression syntax.
This commit is contained in:
PedroHMCosme
2026-09-22 15:59:36 -03:00
parent c0fd5c1b50
commit 54408d6160
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ingestor/io/data_sink.py
View File

@@ -54,7 +54,7 @@ class DataSink:
# schema/table are allowlist-validated identifiers above; status/timestamp/model_id # schema/table are allowlist-validated identifiers above; status/timestamp/model_id
# are bound params below, never interpolated — not a real injection vector. # are bound params below, never interpolated — not a real injection vector.
stmt = text( stmt = text(
f'UPDATE {schema}.{table} SET write_status = :status ' # noqa: S608 f'UPDATE {schema}.{table} SET write_status = :status ' # noqa: S608 # nosec B608
'WHERE timestamp = :timestamp AND model_id = :model_id' 'WHERE timestamp = :timestamp AND model_id = :model_id'
) )
params = { params = {