From c203cc868ce847c3f0528700e3ed3f96683e70c3 Mon Sep 17 00:00:00 2001
From: The MMGen Project <mmgen@tuta.io>
Date: Sat, 24 Oct 2026 15:56:46 +0000
Subject: [PATCH] bandit: pyproject.toml, directives, remove `eval()`

---
 mmgen_node_tools/BlocksInfo.py  | 6 ++----
 mmgen_node_tools/Sound.py       | 2 +-
 mmgen_node_tools/Ticker.py      | 6 ++++--
 pyproject.toml                  | 9 +++++++++
 test/modtest_d/ut_BlocksInfo.py | 1 -
 5 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/mmgen_node_tools/BlocksInfo.py b/mmgen_node_tools/BlocksInfo.py
index 4cd030b..2446ae0 100644
--- a/mmgen_node_tools/BlocksInfo.py
+++ b/mmgen_node_tools/BlocksInfo.py
@@ -62,14 +62,12 @@ class RangeParser:
 		return (None, None)
 
 	def parse_add(self):
-		m = re.match(r'\+([0-9*]+)(.*)', self.arg)
+		m = re.match(r'\+([0-9]+)(.*)', self.arg)
 		if m:
 			res, self.arg = (m[1], m[2])
-			if res.strip('*') != res:
-				die(1, f"'+{res}': malformed nBlocks specifier")
 			if len(res) > 30:
 				die(1, f"'+{res}': overly long nBlocks specifier")
-			return self.caller.check_nblocks(eval(res)) # res is only digits plus '*', so eval safe
+			return self.caller.check_nblocks(int(res))
 
 class BlocksInfo:
 
diff --git a/mmgen_node_tools/Sound.py b/mmgen_node_tools/Sound.py
index 389da42..babce9e 100644
--- a/mmgen_node_tools/Sound.py
+++ b/mmgen_node_tools/Sound.py
@@ -23,7 +23,7 @@ from mmgen.util import die
 
 from mmgen_node_tools.Util import do_system
 
-_alsa_config_file = '/tmp/alsa-config-' + os.path.basename(sys.argv[0])
+_alsa_config_file = f'/tmp/alsa-config-{os.path.basename(sys.argv[0])}' # nosec B108 # unused code
 _dvols = {'Master': 78, 'Speaker': 78, 'Headphone': 15, 'PCM': 190}
 
 def timespec2secs(ts):
diff --git a/mmgen_node_tools/Ticker.py b/mmgen_node_tools/Ticker.py
index d01b2ae..8037e8c 100644
--- a/mmgen_node_tools/Ticker.py
+++ b/mmgen_node_tools/Ticker.py
@@ -65,7 +65,9 @@ class DataSource:
 
 	@classmethod
 	def get_sources(cls, randomize=False):
-		g = random.sample(cls.source_groups, k=len(cls.source_groups)) if randomize else cls.source_groups
+		g = (
+			random.sample(cls.source_groups, k=len(cls.source_groups)) # nosec B311 # non-cryptographic use
+			if randomize else cls.source_groups)
 		return {k: v for a in g for k, v in a.items()}
 
 	class base:
@@ -73,7 +75,7 @@ class DataSource:
 		def fetch_delay(self):
 			global last_api_host
 			if not gcfg.testing and last_api_host and last_api_host != self.api_host:
-				delay = 1 + random.randrange(1, 5000) / 1000
+				delay = 1 + random.randrange(1, 5000) / 1000 # nosec B311 # non-cryptographic use
 				msg_r(f'Waiting {delay:.3f} seconds...')
 				time.sleep(delay)
 				msg('')
diff --git a/pyproject.toml b/pyproject.toml
index c1b6b76..e5af33e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -5,6 +5,15 @@ requires = [
 ]
 build-backend = "setuptools.build_meta"
 
+[tool.bandit]
+exclude_dirs = ["test/overlay/tree"]
+skips = [
+	# severity level low:
+	"B101", # assert_used
+	"B404", # import_subprocess (blacklist)
+	"B603", # subprocess - check for execution of untrusted input
+]
+
 [tool.ruff]
 line-length = 106
 indent-width = 4
diff --git a/test/modtest_d/ut_BlocksInfo.py b/test/modtest_d/ut_BlocksInfo.py
index b301a66..b3fb346 100755
--- a/test/modtest_d/ut_BlocksInfo.py
+++ b/test/modtest_d/ut_BlocksInfo.py
@@ -41,7 +41,6 @@ range_vecs = (
 	(f'{tip-1}-cur',   (tip-1,    tip,    None, None, None),  (tip-1,    tip,    None) ),
 	( '0-cur+3000',    (0,        tip,    None, None, 3000 ), (0,        tip,    list(range(0,tip+1,3000))) ),
 	( '+1440+144',     (tip-1439, tip,    None, 1440, 144 ),  (tip-1439, tip,    list(range(tip-1439,tip+1,144))) ),
-	( '+144*10+12*12', (tip-1439, tip,    None, 1440, 144 ),  (tip-1439, tip,    list(range(tip-1439,tip+1,144))) ),
 )
 
 full_set = ['aa','bbb','ccc_P2','ddddd','eeeeee','ffffffff','gg']