anti/DECNET
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore: fix ruff lint errors, bandit suppressions, and pin pip>=26.0

Browse Source 
Remove unused imports (ruff F401), suppress B324 false positives on
spec-mandated MD5 in HASSH/JA3/JA3S fingerprinting, drop unused
record_version assignment in JARM parser, and pin pip>=26.0 in dev
deps to address CVE-2025-8869 and CVE-2026-1703.
This commit is contained in:
anti
2026-04-14 17:32:18 -04:00
parent d5eb60cb41
commit 2d65d74069
5 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
decnet/prober/hassh.py
View File

@@ -208,7 +208,7 @@ def _compute_hassh(kex: str, enc: str, mac: str, comp: str) -> str:
Returns 32-character lowercase hex digest. Returns 32-character lowercase hex digest.
""" """
raw = f"{kex};{enc};{mac};{comp}" raw = f"{kex};{enc};{mac};{comp}"
return hashlib.md5(raw.encode("utf-8")).hexdigest() return hashlib.md5(raw.encode("utf-8")).hexdigest() # nosec B324
# ─── Public API ───────────────────────────────────────────────────────────── # ─── Public API ─────────────────────────────────────────────────────────────

2
decnet/prober/jarm.py
View File

@@ -297,7 +297,7 @@ def _parse_server_hello(data: bytes) -> str:
if data[0] != _CONTENT_HANDSHAKE: if data[0] != _CONTENT_HANDSHAKE:
return "|||" return "|||"
record_version = struct.unpack_from("!H", data, 1)[0] struct.unpack_from("!H", data, 1)[0] # record_version (unused)
record_len = struct.unpack_from("!H", data, 3)[0] record_len = struct.unpack_from("!H", data, 3)[0]
hs = data[5: 5 + record_len] hs = data[5: 5 + record_len]

5
decnet/sniffer/fingerprint.py
View File

@@ -12,7 +12,6 @@ from __future__ import annotations
import hashlib import hashlib
import struct import struct
import time import time
from pathlib import Path
from typing import Any, Callable from typing import Any, Callable
from decnet.sniffer.syslog import SEVERITY_INFO, SEVERITY_WARNING, syslog_line from decnet.sniffer.syslog import SEVERITY_INFO, SEVERITY_WARNING, syslog_line
@@ -519,7 +518,7 @@ def _ja3(ch: dict[str, Any]) -> tuple[str, str]:
"-".join(str(p) for p in ch["ec_point_formats"]), "-".join(str(p) for p in ch["ec_point_formats"]),
] ]
ja3_str = ",".join(parts) ja3_str = ",".join(parts)
return ja3_str, hashlib.md5(ja3_str.encode()).hexdigest() return ja3_str, hashlib.md5(ja3_str.encode()).hexdigest() # nosec B324
def _ja3s(sh: dict[str, Any]) -> tuple[str, str]: def _ja3s(sh: dict[str, Any]) -> tuple[str, str]:
@@ -529,7 +528,7 @@ def _ja3s(sh: dict[str, Any]) -> tuple[str, str]:
"-".join(str(e) for e in sh["extensions"]), "-".join(str(e) for e in sh["extensions"]),
] ]
ja3s_str = ",".join(parts) ja3s_str = ",".join(parts)
return ja3s_str, hashlib.md5(ja3s_str.encode()).hexdigest() return ja3s_str, hashlib.md5(ja3s_str.encode()).hexdigest() # nosec B324
# ─── JA4 / JA4S ───────────────────────────────────────────────────────────── # ─── JA4 / JA4S ─────────────────────────────────────────────────────────────

2
decnet/sniffer/worker.py
View File

@@ -14,9 +14,7 @@ import asyncio
import os import os
import subprocess import subprocess
import threading import threading
import time
from pathlib import Path from pathlib import Path
from typing import Any
from decnet.logging import get_logger from decnet.logging import get_logger
from decnet.network import HOST_MACVLAN_IFACE from decnet.network import HOST_MACVLAN_IFACE

1
pyproject.toml
View File

@@ -28,6 +28,7 @@ dev = [
"pytest>=9.0.3", "pytest>=9.0.3",
"ruff>=0.15.10", "ruff>=0.15.10",
"bandit>=1.9.4", "bandit>=1.9.4",
"pip>=26.0",
"pip-audit>=2.10.0", "pip-audit>=2.10.0",
"httpx>=0.28.1", "httpx>=0.28.1",
"hypothesis>=6.151.14", "hypothesis>=6.151.14",