[flake8-bandit] Fix S103 false positives and negatives in mask analysis by anishgirianish · Pull Request #24424 · astral-sh/ruff

anishgirianish · 2026-04-05T22:21:24Z

Summary

Rewrites parse_mask as a known-bits abstract domain over u64, so partial bitwise expressions (|,&, ^) are tracked through unknown operands. This fixes:

mode | 0o777 — previously unflagged, now reports the statically-known dangerous bits.
0o777777 & 0o700 — previously a false positive (u16 overflow), now correctly silent.
0o777777 & 0o777 — now flagged as permissive, not "invalid mask".

"Invalid mask" now triggers when a bit outside 0o7777 is statically set, keeping 0o1000 (sticky) valid per RUF064 note.

Under preview, the dangerous-bit set matches upstream Bandit (0o33) instead of the current 0o12.

Test Plan

New fixture cases for each repro + partial |/& edges; stable snapshot updated, preview diff snapshot added.
cargo nextest run -p ruff_linter -- flake8_bandit .
Ecosystem checks ran locally

astral-sh-bot · 2026-04-05T22:30:35Z

`ruff-ecosystem` results

Linter (stable)

ℹ️ ecosystem check detected linter changes. (+1 -0 violations, +0 -0 fixes in 1 projects; 55 projects unchanged)

apache/airflow (+1 -0 violations, +0 -0 fixes)

ruff check --no-cache --exit-zero --no-fix --output-format concise --no-preview --select ALL

+ airflow-e2e-tests/tests/airflow_e2e_tests/conftest.py:59:39: S103 `os.chmod` setting a permissive mask `0o111` on file or directory

Changes by rule (1 rules affected)

code	total	+ violation	- violation	+ fix	- fix
S103	1	1	0	0	0

Linter (preview)

ℹ️ ecosystem check detected linter changes. (+1 -0 violations, +0 -0 fixes in 1 projects; 55 projects unchanged)

apache/airflow (+1 -0 violations, +0 -0 fixes)

ruff check --no-cache --exit-zero --no-fix --output-format concise --preview --select ALL

+ airflow-e2e-tests/tests/airflow_e2e_tests/conftest.py:59:39: S103 `os.chmod` setting a permissive mask `0o111` on file or directory

Changes by rule (1 rules affected)

code	total	+ violation	- violation	+ fix	- fix
S103	1	1	0	0	0

MichaReiser

This is clever. There's one false positve that we should look into

anishgirianish · 2026-04-09T05:53:50Z

@MichaReiser Thank you so much for the review. Addressed all three comments:

Added KnownBits::invalid() helper
Added KnownBits::unknown(), replaced all default() calls
Fixed the large-int false positive with an oversized flag on KnownBits, also resolved the ecosystem FP by guarding the Permissive check with is_fully_known()

Would like to request you for another look whenever you get a chance.

Thank you

…ositive in S103

anishgirianish · 2026-04-09T19:44:48Z

@MichaReiser Thank you so much for the re-review. Addressed both comments, would appreciate another look whenever you get a chance.

Thank you

MichaReiser · 2026-04-10T06:36:15Z

Perfect, thank you

…n dangerous bits

* main: [ty] Fix bad diagnostic range for incorrect implicit `__init_subclass__` calls (#24541) [ty] Add a `SupportedPythonVersion` enum (#24412) [ty] Ignore unsupported editor-selected Python versions (#24498) [ty] Add snapshots for `__init_subclass__` diagnostics (#24539) [ty] Minor fix in tests (#24538) [ty] Allow `Final` variable assignments in `__post_init__` (#24529) [ty] Expand test suite for assignment errors (#24537) [ty] Use `map`, not `__map`, as the name of the mapping parameter in `TypedDict` `__init__` methods (#24535) [ty] Rework logic for synthesizing `TypedDict` methods (#24534) [flake8-bandit] Fix S103 false positives and negatives in mask analysis (#24424) [ty] mdtest.py: update dependencies (#24533) Rename patterns and arguments source order iterator method (#24532) [ty] Omit invalid keyword arguments from `TypedDict` signature (#24522) [ty] support super() in metaclass methods (#24483) [ty] Synthesize `__init__` for `TypedDict` (#24476)

* main: Bump typing conformance suite commit to latest upstream (#24553) [ty] Reject deleting`Final` attributes (#24508) [ty] Respect property deleters in attribute deletion checks (#24500) [ty] stop unioning Unknown into types of un-annotated attributes (#24531) [ty] Fix bad diagnostic range for incorrect implicit `__init_subclass__` calls (#24541) [ty] Add a `SupportedPythonVersion` enum (#24412) [ty] Ignore unsupported editor-selected Python versions (#24498) [ty] Add snapshots for `__init_subclass__` diagnostics (#24539) [ty] Minor fix in tests (#24538) [ty] Allow `Final` variable assignments in `__post_init__` (#24529) [ty] Expand test suite for assignment errors (#24537) [ty] Use `map`, not `__map`, as the name of the mapping parameter in `TypedDict` `__init__` methods (#24535) [ty] Rework logic for synthesizing `TypedDict` methods (#24534) [flake8-bandit] Fix S103 false positives and negatives in mask analysis (#24424) [ty] mdtest.py: update dependencies (#24533) Rename patterns and arguments source order iterator method (#24532) [ty] Omit invalid keyword arguments from `TypedDict` signature (#24522) [ty] support super() in metaclass methods (#24483) [ty] Synthesize `__init__` for `TypedDict` (#24476)

@dylwil3

##### [\`v0.15.12\`](https://github.com/astral-sh/ruff/blob/HEAD/CHANGELOG.md#01512) Released on 2026-04-24. ##### Preview features - Implement `#ruff:file-ignore` file-level suppressions ([#23599](astral-sh/ruff#23599)) - Implement `#ruff:ignore` logical-line suppressions ([#23404](astral-sh/ruff#23404)) - Revert preview changes to displayed diagnostic severity in LSP ([#24789](astral-sh/ruff#24789)) - \[`airflow`] Implement `task-branch-as-short-circuit` (`AIR004`) ([#23579](astral-sh/ruff#23579)) - \[`flake8-bugbear`] Fix `break`/`continue` handling in `loop-iterator-mutation` (`B909`) ([#24440](astral-sh/ruff#24440)) - \[`pylint`] Fix `PLC2701` for type parameter scopes ([#24576](astral-sh/ruff#24576)) ##### Rule changes - \[`pandas-vet`] Suggest `.array` as well in `PD011` ([#24805](astral-sh/ruff#24805)) ##### CLI - Respect default Unix permissions for cache files ([#24794](astral-sh/ruff#24794)) ##### Documentation - \[`pylint`] Fix `PLR0124` description not to claim self-comparison always returns the same value ([#24749](astral-sh/ruff#24749)) - \[`pyupgrade`] Expand docs on reusable `TypeVar`s and scoping (`UP046`) ([#24153](astral-sh/ruff#24153)) - Improve rules table accessibility ([#24711](astral-sh/ruff#24711)) ##### Contributors - [@dylwil3](https://github.com/dylwil3) - [@AlexWaygood](https://github.com/AlexWaygood) - [@woodruffw](https://github.com/woodruffw) - [@avasis-ai](https://github.com/avasis-ai) - [@Dev-iL](https://github.com/Dev-iL) - [@denyszhak](https://github.com/denyszhak) - [@ShipItAndPray](https://github.com/ShipItAndPray) - [@anishgirianish](https://github.com/anishgirianish) - [@augustelalande](https://github.com/augustelalande) - [@amyreese](https://github.com/amyreese) - [@majiayu000](https://github.com/majiayu000) ##### [\`v0.15.11\`](https://github.com/astral-sh/ruff/blob/HEAD/CHANGELOG.md#01511) Released on 2026-04-16. ##### Preview features - \[`ruff`] Ignore `RUF029` when function is decorated with `asynccontextmanager` ([#24642](astral-sh/ruff#24642)) - \[`airflow`] Implement `airflow-xcom-pull-in-template-string` (`AIR201`) ([#23583](astral-sh/ruff#23583)) - \[`flake8-bandit`] Fix `S103` false positives and negatives in mask analysis ([#24424](astral-sh/ruff#24424)) ##### Bug fixes - \[`flake8-async`] Omit overridden methods for `ASYNC109` ([#24648](astral-sh/ruff#24648)) ##### Documentation - \[`flake8-async`] Add override mention to `ASYNC109` docs ([#24666](astral-sh/ruff#24666)) - Update Neovim config examples to use `vim.lsp.config` ([#24577](astral-sh/ruff#24577)) ##### Contributors - [@augustelalande](https://github.com/augustelalande) - [@anishgirianish](https://github.com/anishgirianish) - [@benberryallwood](https://github.com/benberryallwood) - [@charliermarsh](https://github.com/charliermarsh) - [@Dev-iL](https://github.com/Dev-iL) Renovate-Branch: renovate/2024.6-ruff-0.15.x Change-Id: I2c5de44f14ce3133db71161eae18c7b43f7ba09b Priv-Id: 9c1a7f10043a2db2338a90de9a62a4d7989df14d

[flake8-bandit] Fix S103 false positives and negatives in mask analysis

d2525c9

astral-sh-bot Bot assigned ntBre Apr 5, 2026

astral-sh-bot Bot requested a review from ntBre April 5, 2026 22:21

MichaReiser added rule Implementing or modifying a lint rule preview Related to preview mode features labels Apr 7, 2026

MichaReiser requested changes Apr 8, 2026

View reviewed changes

Comment thread crates/ruff_linter/src/rules/flake8_bandit/rules/bad_file_permissions.rs Outdated

Comment thread crates/ruff_linter/src/rules/flake8_bandit/rules/bad_file_permissions.rs Outdated

Comment thread crates/ruff_linter/src/rules/flake8_bandit/rules/bad_file_permissions.rs

[flake8-bandit] address review feeback

fd44836

anishgirianish requested a review from MichaReiser April 9, 2026 05:54

MichaReiser approved these changes Apr 9, 2026

View reviewed changes

Comment thread crates/ruff_linter/src/rules/flake8_bandit/rules/bad_file_permissions.rs Outdated

Comment thread crates/ruff_linter/src/rules/flake8_bandit/rules/bad_file_permissions.rs Outdated

MichaReiser assigned MichaReiser and unassigned ntBre Apr 9, 2026

anishgirianish added 3 commits April 9, 2026 13:51

[flake8-bandit] refactor

66b28c9

[flake8-bandit] Use ComparableExpr to eliminate oversized XOR false p…

6eff0d9

…ositive in S103

[flake8-bandit] fix formatting

34aeaaa

MichaReiser reviewed Apr 10, 2026

View reviewed changes

Comment thread crates/ruff_linter/resources/test/fixtures/flake8_bandit/S103.py Outdated

[flake8-bandit] Flag S103 partial-OR expressions with statically-know…

1a11987

…n dangerous bits

MichaReiser merged commit e1f1875 into astral-sh:main Apr 10, 2026
44 checks passed

BrewTestBot mentioned this pull request Apr 16, 2026

ruff 0.15.11 Homebrew/homebrew-core#277971

Merged

This was referenced Apr 27, 2026

Always include panic payload in panic diagnostic message #24873

Merged

ASCII identifier fast path #24876

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[flake8-bandit] Fix S103 false positives and negatives in mask analysis#24424

[flake8-bandit] Fix S103 false positives and negatives in mask analysis#24424
MichaReiser merged 6 commits into
astral-sh:mainfrom
anishgirianish:fix-s103-bad-file-permissions

anishgirianish commented Apr 5, 2026 •

edited

Loading

Uh oh!

astral-sh-bot Bot commented Apr 5, 2026 •

edited

Loading

Uh oh!

MichaReiser left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

anishgirianish commented Apr 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

anishgirianish commented Apr 9, 2026 •

edited

Loading

Uh oh!

MichaReiser commented Apr 10, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

anishgirianish commented Apr 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test Plan

Uh oh!

astral-sh-bot Bot commented Apr 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ruff-ecosystem results

Linter (stable)

Linter (preview)

Uh oh!

MichaReiser left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

anishgirianish commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

anishgirianish commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MichaReiser commented Apr 10, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

anishgirianish commented Apr 5, 2026 •

edited

Loading

astral-sh-bot Bot commented Apr 5, 2026 •

edited

Loading

`ruff-ecosystem` results

anishgirianish commented Apr 9, 2026 •

edited

Loading

anishgirianish commented Apr 9, 2026 •

edited

Loading