From 158c591913f059da7afdff9361c52fb320eba41a Mon Sep 17 00:00:00 2001
From: The MMGen Project <mmgen@tuta.io>
Date: Mon, 17 Aug 2026 09:05:13 +0000
Subject: [PATCH] bandit fixes and cleanups

---
 mmgen/autosign/__init__.py         |  4 ++--
 mmgen/cfg.py                       |  8 ++++----
 mmgen/color.py                     |  6 +++---
 mmgen/led.py                       |  6 +-----
 mmgen/main_autosign.py             |  2 +-
 mmgen/proto/bch/cashaddr.py        |  4 ++--
 mmgen/proto/btc/regtest.py         |  2 +-
 mmgen/proto/btc/tw/txhistory.py    |  2 +-
 mmgen/protocol.py                  |  2 +-
 mmgen/tx/base.py                   |  2 +-
 mmgen/util2.py                     |  2 +-
 pyproject.toml                     |  8 +++++++-
 test/overlay/fakemods/mmgen/led.py | 10 ++++++++++
 test/test-release.sh               |  2 +-
 14 files changed, 36 insertions(+), 24 deletions(-)
 create mode 100644 test/overlay/fakemods/mmgen/led.py

diff --git a/mmgen/autosign/__init__.py b/mmgen/autosign/__init__.py
index ada03325..d329a14a 100755
--- a/mmgen/autosign/__init__.py
+++ b/mmgen/autosign/__init__.py
@@ -81,7 +81,7 @@ class Autosign:
 		match gc.platform:
 			case 'linux':
 				self.dfl_mountpoint = f'/mnt/{self.linux_mount_subdir}'
-				self.dfl_shm_dir    = '/dev/shm'
+				self.dfl_shm_dir    = '/dev/shm' # nosec B108 # (used on offline device only)
 
 				# linux-only attrs:
 				self.old_dfl_mountpoint = '/mnt/tx'
@@ -420,7 +420,7 @@ class Autosign:
 				'_clone': self.cfg,
 				'coin': 'xmr',
 				'wallet_rpc_user': 'autosign',
-				'wallet_rpc_password': 'autosign password',
+				'wallet_rpc_password': 'autosign password', # nosec # B105 (offline device use only)
 				'wallet_rpc_port': 23232 if self.cfg.test_suite_xmr_autosign else None,
 				'wallet_dir': str(self.wallet_dir),
 				'autosign': True,
diff --git a/mmgen/cfg.py b/mmgen/cfg.py
index 8be8f389..943174fd 100755
--- a/mmgen/cfg.py
+++ b/mmgen/cfg.py
@@ -158,9 +158,9 @@ class Config(Lockable):
 
 	# general
 	coin        = 'BTC'
-	token       = ''
+	token       = '' # nosec B105
 	outdir      = ''
-	passwd_file = ''
+	passwd_file = '' # nosec B105
 	network     = 'mainnet'
 	testnet     = False
 	regtest     = False
@@ -201,7 +201,7 @@ class Config(Lockable):
 	rpc_host              = ''
 	rpc_port              = 0
 	rpc_user              = ''
-	rpc_password          = ''
+	rpc_password          = '' # nosec B105 # empty pw rejected, user must set, see BitcoinRPCClient
 	aiohttp_rpc_queue_len = 16
 	aiohttp_session       = None
 	cached_balances       = False
@@ -243,7 +243,7 @@ class Config(Lockable):
 
 	# Monero:
 	monero_wallet_rpc_user     = 'monero'
-	monero_wallet_rpc_password = ''
+	monero_wallet_rpc_password = '' # nosec B105 # empty pw rejected, user must set, see MoneroWalletDaemon
 	monero_daemon              = ''
 	xmrwallet_compat           = False
 	priority                   = 0
diff --git a/mmgen/color.py b/mmgen/color.py
index 35428c60..cd8da0fc 100755
--- a/mmgen/color.py
+++ b/mmgen/color.py
@@ -53,7 +53,7 @@ def set_vt100():
 	'hack to put term into VT100 mode under MSWin'
 	if gc.platform == 'win32':
 		from subprocess import run
-		run([], shell=True) # nosec
+		run([], shell=True) # nosec B602
 
 def get_terminfo_colors(term=None):
 	from subprocess import run, PIPE
@@ -106,13 +106,13 @@ def init_color(num_colors='auto'):
 				start = (
 					'\033[38;5;{};1m'.format(e[0]) if type(e[0]) == int else
 					'\033[38;5;{};48;5;{};1m'.format(*e[0]))
-				getattr(self, c).__code__ = eval(f'(lambda s: "{start}" + s + "{reset}").__code__') # nosec
+				getattr(self, c).__code__ = eval(f'(lambda s: "{start}" + s + "{reset}").__code__') # nosec B307
 		case 8 | 16:
 			for c, e in _colors.items():
 				start = (
 					'\033[{}m'.format(e[1][0]) if e[1][1] == 0 else
 					'\033[{};{}m'.format(*e[1]))
-				getattr(self, c).__code__ = eval(f'(lambda s: "{start}" + s + "{reset}").__code__') # nosec
+				getattr(self, c).__code__ = eval(f'(lambda s: "{start}" + s + "{reset}").__code__') # nosec B307
 
 	set_vt100()
 
diff --git a/mmgen/led.py b/mmgen/led.py
index 4ae1e6c2..9b9ccf12 100755
--- a/mmgen/led.py
+++ b/mmgen/led.py
@@ -81,11 +81,7 @@ class LEDControl:
 			name    = 'Nano Pi M6 (Armbian)',
 			control = '/sys/class/leds/user_led/brightness',
 			trigger = '/sys/class/leds/user_led/trigger',
-			color   = 'green'),
-		'dummy': binfo(
-			name    = 'Fake Board',
-			control = '/tmp/led_status',
-			trigger = '/tmp/led_trigger')}
+			color   = 'green')}
 
 	def __init__(self, *, enabled, simulate=False, debug=False):
 
diff --git a/mmgen/main_autosign.py b/mmgen/main_autosign.py
index cde02fe7..eabbb52d 100755
--- a/mmgen/main_autosign.py
+++ b/mmgen/main_autosign.py
@@ -120,7 +120,7 @@ if cmd in ('enable_swap', 'disable_swap', 'list_led', 'test_led'):
 			if cmd == 'list_led':
 				msg(
 					'Boards with tested LED signaling support:\n' +
-					'\n'.join(f'  {v.name}' for k, v in LEDControl.boards.items() if k != 'dummy'))
+					'\n'.join(f'  {v.name}' for k, v in LEDControl.boards.items()))
 			else:
 				from .exception import NoLEDSupport
 				try:
diff --git a/mmgen/proto/bch/cashaddr.py b/mmgen/proto/bch/cashaddr.py
index 6f84f428..86a349f7 100755
--- a/mmgen/proto/bch/cashaddr.py
+++ b/mmgen/proto/bch/cashaddr.py
@@ -29,8 +29,8 @@ b32a = re.sub(r'\s', '', b32_matrix)
 cashaddr_addr_types = {
 	'p2pkh':        0,
 	'p2sh':         1,
-	'token_pubkey': 2,
-	'token_script': 3,
+	'token_pubkey': 2, # nosec # B105
+	'token_script': 3, # nosec # B105
 	'unknown':      15,
 }
 addr_types_rev = {v: k for k, v in cashaddr_addr_types.items()}
diff --git a/mmgen/proto/btc/regtest.py b/mmgen/proto/btc/regtest.py
index 81da7a2f..8e286889 100755
--- a/mmgen/proto/btc/regtest.py
+++ b/mmgen/proto/btc/regtest.py
@@ -51,7 +51,7 @@ def create_data_dir(cfg, data_dir):
 class MMGenRegtest(MMGenObject):
 
 	rpc_user     = 'bobandalice'
-	rpc_password = 'hodltothemoon'
+	rpc_password = 'hodltothemoon' # nosec B105
 	users        = ('bob', 'alice', 'carol', 'miner')
 	coins        = ('btc', 'bch', 'ltc')
 	usr_cmds     = (
diff --git a/mmgen/proto/btc/tw/txhistory.py b/mmgen/proto/btc/tw/txhistory.py
index 9693ddcf..7a22ff0a 100755
--- a/mmgen/proto/btc/tw/txhistory.py
+++ b/mmgen/proto/btc/tw/txhistory.py
@@ -303,7 +303,7 @@ class BitcoinTwTxHistory(BitcoinTwView, TwTxHistory, BitcoinTwRPC):
 			def do_json_dump(*data):
 				nw = f'{self.proto.coin.lower()}-{self.proto.network}'
 				for d, fn_stem in data:
-					with open(f'/tmp/{fn_stem}-{nw}.json', 'w') as fh:
+					with open(f'debug-{fn_stem}-{nw}.json', 'w') as fh:
 						fh.write(json.dumps(d, cls=json_encoder))
 
 		_mmp = namedtuple('mmap_datum', ['twmmid', 'comment'])
diff --git a/mmgen/protocol.py b/mmgen/protocol.py
index e23ea427..30d05beb 100755
--- a/mmgen/protocol.py
+++ b/mmgen/protocol.py
@@ -214,7 +214,7 @@ class CoinProtocol(MMGenObject):
 		rpc_host              = ''
 		rpc_port              = 0
 		rpc_user              = ''
-		rpc_password          = ''
+		rpc_password          = '' # nosec B105 # empty pw rejected, user must set, see BitcoinRPCClient
 		tw_name               = ''
 		daemon_id             = ''
 
diff --git a/mmgen/tx/base.py b/mmgen/tx/base.py
index f41319f4..c120f0ad 100755
--- a/mmgen/tx/base.py
+++ b/mmgen/tx/base.py
@@ -89,7 +89,7 @@ class Base(MMGenObject):
 		'swap_recv_addr_mmid': None,
 		'swap_recv_asset_spec': None,
 		'swap_memo': None,
-		'token_vault_addr': None,
+		'token_vault_addr': None, # nosec # B105
 		'serialized2': None,
 		'coin_txid2': CoinTxID}
 	file_format  = 'json'
diff --git a/mmgen/util2.py b/mmgen/util2.py
index bcbf5279..4f443b1e 100755
--- a/mmgen/util2.py
+++ b/mmgen/util2.py
@@ -94,7 +94,7 @@ def get_keccak(cfg=None, cached_ret=[]):
 			from .contrib.keccak import keccak_256
 		elif not (keccak_256 := get_hashlib_keccak()):
 			load_cryptodome()
-			from Crypto.Hash import keccak # nosec # pylint: disable=import-error
+			from Crypto.Hash import keccak # nosec B413 # pylint: disable=import-error
 			keccak_256 = lambda data: keccak.new(data=data, digest_bytes=32)
 		cached_ret.append(keccak_256)
 
diff --git a/pyproject.toml b/pyproject.toml
index db3728eb..f0300ade 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,8 +7,14 @@ requires = [
 build-backend = "setuptools.build_meta"
 
 [tool.bandit]
+exclude_dirs = ["test/overlay/tree"]
 skips = [
-	"B108", # hardcoded_tmp_directory: probable insecure usage of temp file/directory
+	# severity level low:
+	"B101", # assert_used
+	"B404", # import_subprocess (blacklist)
+	"B603", # subprocess - check for execution of untrusted input
+	"B607", # subprocess - starting a process with a partial executable path
+	"B110", # try_except_pass: Try, Except, Pass detected
 ]
 
 [tool.ruff]
diff --git a/test/overlay/fakemods/mmgen/led.py b/test/overlay/fakemods/mmgen/led.py
new file mode 100644
index 00000000..6da2c487
--- /dev/null
+++ b/test/overlay/fakemods/mmgen/led.py
@@ -0,0 +1,10 @@
+from .led_orig import *
+
+class overlay_fake_LEDControl:
+	boards = {
+		'dummy': LEDControl.binfo(
+			name    = 'Dummy Testing Board',
+			control = 'test/tmp/led_status',
+			trigger = 'test/tmp/led_trigger')}
+
+LEDControl.boards.update(overlay_fake_LEDControl.boards)
diff --git a/test/test-release.sh b/test/test-release.sh
index 1e874354..1505aa30 100755
--- a/test/test-release.sh
+++ b/test/test-release.sh
@@ -279,7 +279,7 @@ altcoin_mod_opts='--quiet'
 mmgen_tool='cmds/mmgen-tool'
 pylint='pylint'
 ruff='ruff --silent'
-bandit='bandit --silent --recursive --severity-level=medium --configfile=pyproject.toml'
+bandit='bandit --silent --recursive --severity-level=all --configfile=pyproject.toml'
 python='python3'
 rounds=10
 typescript_file='test-release.out'