Repository: PyCQA/bandit (python)

Issue:
Invalid checking in hashlib plugin
### Describe the bug

The hashlib_insecure_functions.py plugin is checkin for arguments that don't exist. For example, there is no kwarg for 'name'. The actual signature of the function is:

```
>>> inspect.signature(hashlib.new)
<Signature (name, data=b'', **kwargs)>

>>> inspect.signature(hashlib.md5)
<Signature (string=b'', *, usedforsecurity=True)>
```

The hashlib_new_insecure_functions example also includes a bunch of invalid examples.

### Reproduction steps

See https://docs.python.org/3/library/hashlib.html

```
hashlib.new(name, [data, ]*, usedforsecurity=True)
```

### Expected behavior

The checking should be accurate to the function API.

### Bandit version

1.7.4 (Default)

### Python version

3.9

### Additional context

_No response_

Pull request:
Remove invalid checking on hashlib
* hashlib does not support name as the kwargs argument
* 'string' is not a keyword of kwargs

Fixes #865

Signed-off-by: Eric Brown <eric_wade_brown@yahoo.com>

Patch:
diff --git a/examples/hashlib_new_insecure_functions.py b/examples/hashlib_new_insecure_functions.py
index 914b305..f7855bd 100644
--- a/examples/hashlib_new_insecure_functions.py
+++ b/examples/hashlib_new_insecure_functions.py
@@ -2,21 +2,19 @@ import hashlib
 
 hashlib.new('md5')
 
-hashlib.new('md4', 'test')
+hashlib.new('md4', b'test')
 
-hashlib.new(name='md5', string='test')
+hashlib.new(name='md5', data=b'test')
 
-hashlib.new('MD4', string='test')
-
-hashlib.new(string='test', name='MD5')
+hashlib.new('MD4', data=b'test')
 
 hashlib.new('sha1')
 
-hashlib.new(string='test', name='SHA1')
+hashlib.new('sha1', data=b'test')
 
-hashlib.new('sha', string='test')
+hashlib.new('sha', data=b'test')
 
-hashlib.new(name='SHA', string='test')
+hashlib.new(name='SHA', data=b'test')
 
 # usedforsecurity arg only availabe in Python 3.9+
 hashlib.new('sha1', usedforsecurity=True)


Test patch:
diff --git a/tests/functional/test_functional.py b/tests/functional/test_functional.py
index d39ee79..7b83d79 100644
--- a/tests/functional/test_functional.py
+++ b/tests/functional/test_functional.py
@@ -828,13 +828,13 @@ class FunctionalTests(testtools.TestCase):
                     "UNDEFINED": 0,
                     "LOW": 0,
                     "MEDIUM": 0,
-                    "HIGH": 10,
+                    "HIGH": 9,
                 },
                 "CONFIDENCE": {
                     "UNDEFINED": 0,
                     "LOW": 0,
                     "MEDIUM": 0,
-                    "HIGH": 10,
+                    "HIGH": 9,
                 },
             }
         else:
@@ -842,14 +842,14 @@ class FunctionalTests(testtools.TestCase):
                 "SEVERITY": {
                     "UNDEFINED": 0,
                     "LOW": 0,
-                    "MEDIUM": 11,
+                    "MEDIUM": 10,
                     "HIGH": 0,
                 },
                 "CONFIDENCE": {
                     "UNDEFINED": 0,
                     "LOW": 0,
                     "MEDIUM": 0,
-                    "HIGH": 11,
+                    "HIGH": 10,
                 },
             }
         self.check_example("hashlib_new_insecure_functions.py", expect)