Skip to content

Remove use of ramdom.getrandbits.#583

Open
loqs wants to merge 1 commit into
aio-libs:masterfrom
loqs:tox-bandit
Open

Remove use of ramdom.getrandbits.#583
loqs wants to merge 1 commit into
aio-libs:masterfrom
loqs:tox-bandit

Conversation

@loqs

@loqs loqs commented May 7, 2026

Copy link
Copy Markdown
Contributor

What do these changes do?

Remove use of ramdom.getrandbits. The tests for random port use were duplicates. Other uses of getrandombits were converted to fixed ports.

Are there changes in behavior for the user?

No

Related issue number

Related #544

Checklist

  • I think the code is well written
  • Unit tests for the changes exist
  • tox testenvs have been executed in the following environments:
    • Linux (Ubuntu 18.04, Ubuntu 20.04, Arch): {py39.py310,py311,py312}-{nocov,cov,diffcov}, qa, docs
    • Windows (7, 10): {py36,py37,py38,py39}-{nocov,cov,diffcov}
    • WSL 1.0 (Ubuntu 18.04): {py36,py37,py38,py39}-{nocov,cov,diffcov}, pypy3-{nocov,cov}, qa, docs
    • FreeBSD (12.2, 12.1, 11.4): {py36,pypy3}-{nocov,cov,diffcov}, qa
    • Cygwin: py36-{nocov,cov,diffcov}, qa, docs
  • Documentation reflects the changes
  • Add a news fragment into the NEWS.rst file

@loqs

loqs commented May 7, 2026

Copy link
Copy Markdown
Contributor Author

There are multiple alternatives if you prefer:

  • Skip bandit for the tests directory
  • Switch from random to secrets
  • Stop using a random port as the port number is only used for mocking.

@codecov

codecov Bot commented May 7, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.80%. Comparing base (003c265) to head (a1886ec).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master     #583      +/-   ##
==========================================
- Coverage   97.81%   97.80%   -0.01%     
==========================================
  Files          23       23              
  Lines        5714     5695      -19     
  Branches      352      352              
==========================================
- Hits         5589     5570      -19     
  Misses         75       75              
  Partials       50       50              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Comment thread aiosmtpd/tests/test_proxyprotocol.py Outdated
@webknjaz

webknjaz commented Jul 1, 2026

Copy link
Copy Markdown
Member
  • Switch from random to secrets

  • Stop using a random port as the port number is only used for mocking.

I think these two would be preferential over suppressions. Normally, I'd ask for the ephemeral port 0 in e2e tests. But if this is only for mocking, I don't see how randomizing is useful at all, and so I don't have a problem with hardcoding a few values like 666 and 999, for example. This sounds like the cleanest solution to me.

The tests for random port use were duplicates. Other uses of
getrandombits were converted to fixed ports.
@loqs loqs changed the title Silence bandit false positive in test code Remove use of ramdom.getrandbits. Jul 5, 2026
@loqs

loqs commented Jul 5, 2026

Copy link
Copy Markdown
Contributor Author

I think these two would be preferential over suppressions. Normally, I'd ask for the ephemeral port 0 in e2e tests. But if this is only for mocking, I don't see how randomizing is useful at all, and so I don't have a problem with hardcoding a few values like 666 and 999, for example. This sounds like the cleanest solution to me.

After making your proposed change it became clear the tests were duplicates. Confirmed by removing them and cover/diffcover reporting 100% coverage after the removal.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants