Repository: astral-sh/ruff
File: crates/ruff_linter/src/rules/flake8_bandit/rules/snmp_insecure_version.rs (Rust)

Code before:
///
/// ## References
/// - [Cybersecurity and Infrastructure Security Agency (CISA): Alert TA17-156A](https://www.cisa.gov/news-events/alerts/2017/06/05/reducing-risk-snmp-abuse)
/// - [Common Weakness Enumeration: CWE-319](https://cwe.mitre.org/data/definitions/319.html)
#[derive(ViolationMetadata)]
#[violation_metadata(stable_since = "v0.0.218")]
pub(crate) struct SnmpInsecureVersion;

impl Violation for SnmpInsecureVersion {
    #[derive_message_formats]
    fn message(&self) -> String {
        "The use of SNMPv1 and SNMPv2 is insecure. Use SNMPv3 if able.".to_string()
    }
}

/// S508
pub(crate) fn snmp_insecure_version(checker: &Checker, call: &ast::ExprCall) {
    if checker
        .semantic()
        .resolve_qualified_name(&call.func)
        .is_some_and(|qualified_name| {
            let segments = qualified_name.segments();
            segments.len() >= 3
                && segments[0] == "pysnmp"
                && segments[1] == "hlapi"
                && segments[segments.len() - 1] == "CommunityData"
        })
    {
        if let Some(keyword) = call.arguments.find_keyword("mpModel") {
            if matches!(
                keyword.value,
                Expr::NumberLiteral(ast::ExprNumberLiteral {
                    value: ast::Number::Int(Int::ZERO | Int::ONE),
                    ..
                })
            ) {
                checker.report_diagnostic(SnmpInsecureVersion, keyword.range());
            }
        }
    }
}


Review comment (suggestion):
I think we can still use `matches!` here:

```suggestion
           matches!(
           		qualified_name.segments(),
            	["pysnmp", "hlapi", .., "CommunityData"]
           )
```

This is slightly more restrictive than it really needs to be, but it's a lot shorter than enumerating all of the options for what `..` can be, especially when different path lengths are involved.

Code after:
/// ```
///
/// ## References
/// - [Cybersecurity and Infrastructure Security Agency (CISA): Alert TA17-156A](https://www.cisa.gov/news-events/alerts/2017/06/05/reducing-risk-snmp-abuse)
/// - [Common Weakness Enumeration: CWE-319](https://cwe.mitre.org/data/definitions/319.html)
#[derive(ViolationMetadata)]
#[violation_metadata(stable_since = "v0.0.218")]
pub(crate) struct SnmpInsecureVersion;

impl Violation for SnmpInsecureVersion {
    #[derive_message_formats]
    fn message(&self) -> String {
        "The use of SNMPv1 and SNMPv2 is insecure. Use SNMPv3 if able.".to_string()
    }
}

/// S508
pub(crate) fn snmp_insecure_version(checker: &Checker, call: &ast::ExprCall) {
    if checker
        .semantic()
        .resolve_qualified_name(&call.func)
        .is_some_and(|qualified_name| {
            if is_extended_snmp_api_path_detection_enabled(checker.settings()) {
                matches!(
                    qualified_name.segments(),
                    ["pysnmp", "hlapi", .., "CommunityData"]
                )
            } else {
                matches!(
                    qualified_name.segments(),
                    ["pysnmp", "hlapi", "CommunityData"]
                )
            }
        })
    {
        if let Some(keyword) = call.arguments.find_keyword("mpModel") {
            if matches!(
                keyword.value,
                Expr::NumberLiteral(ast::ExprNumberLiteral {
                    value: ast::Number::Int(Int::ZERO | Int::ONE),
                    ..
                })
            ) {
                checker.report_diagnostic(SnmpInsecureVersion, keyword.range());
            }
        }
    }
}