Avoid flagging typed exceptions in tuples (#2728)

crates/ruff/resources/test/fixtures/flake8_bandit/S112.py

@@ -8,7 +8,22 @@ try:
 except:
     continue
 
+try:
+    pass
+except (Exception,):
+    continue
+
+try:
+    pass
+except (Exception, ValueError):
+    continue
+
 try:
     pass
 except ValueError:
     continue
+
+try:
+    pass
+except (ValueError,):
+    continue

crates/ruff/src/rules/flake8_bandit/helpers.rs

@@ -1,5 +1,7 @@
 use rustpython_parser::ast::{Constant, Expr, ExprKind};
 
+use crate::checkers::ast::Checker;
+
 const PASSWORD_NAMES: [&str; 7] = [
     "password", "pass", "passwd", "pwd", "secret", "token", "secrete",
 ];
@@ -20,3 +22,21 @@ pub fn matches_password_name(string: &str) -> bool {
         .iter()
         .any(|name| string.to_lowercase().contains(name))
 }
+
+pub fn is_untyped_exception(type_: Option<&Expr>, checker: &Checker) -> bool {
+    type_.map_or(true, |type_| {
+        if let ExprKind::Tuple { elts, .. } = &type_.node {
+            elts.iter().any(|type_| {
+                checker.resolve_call_path(type_).map_or(false, |call_path| {
+                    call_path.as_slice() == ["", "Exception"]
+                        || call_path.as_slice() == ["", "BaseException"]
+                })
+            })
+        } else {
+            checker.resolve_call_path(type_).map_or(false, |call_path| {
+                call_path.as_slice() == ["", "Exception"]
+                    || call_path.as_slice() == ["", "BaseException"]
+            })
+        }
+    })
+}

crates/ruff/src/rules/flake8_bandit/rules/try_except_continue.rs

@@ -1,9 +1,11 @@
-use ruff_macros::{define_violation, derive_message_formats};
 use rustpython_parser::ast::{Expr, Stmt, StmtKind};
 
+use ruff_macros::{define_violation, derive_message_formats};
+
 use crate::ast::types::Range;
 use crate::checkers::ast::Checker;
 use crate::registry::Diagnostic;
+use crate::rules::flake8_bandit::helpers::is_untyped_exception;
 use crate::violation::Violation;
 
 define_violation!(
@@ -26,13 +28,7 @@ pub fn try_except_continue(
 ) {
     if body.len() == 1
         && body[0].node == StmtKind::Continue
-        && (check_typed_exception
-            || type_.map_or(true, |type_| {
-                checker.resolve_call_path(type_).map_or(true, |call_path| {
-                    call_path.as_slice() == ["", "Exception"]
-                        || call_path.as_slice() == ["", "BaseException"]
-                })
-            }))
+        && (check_typed_exception || is_untyped_exception(type_, checker))
     {
         checker.diagnostics.push(Diagnostic::new(
             TryExceptContinue,

crates/ruff/src/rules/flake8_bandit/rules/try_except_pass.rs

@@ -4,6 +4,7 @@ use rustpython_parser::ast::{Expr, Stmt, StmtKind};
 use crate::ast::types::Range;
 use crate::checkers::ast::Checker;
 use crate::registry::Diagnostic;
+use crate::rules::flake8_bandit::helpers::is_untyped_exception;
 use crate::violation::Violation;
 
 define_violation!(
@@ -26,13 +27,7 @@ pub fn try_except_pass(
 ) {
     if body.len() == 1
         && body[0].node == StmtKind::Pass
-        && (check_typed_exception
-            || type_.map_or(true, |type_| {
-                checker.resolve_call_path(type_).map_or(true, |call_path| {
-                    call_path.as_slice() == ["", "Exception"]
-                        || call_path.as_slice() == ["", "BaseException"]
-                })
-            }))
+        && (check_typed_exception || is_untyped_exception(type_, checker))
     {
         checker.diagnostics.push(Diagnostic::new(
             TryExceptPass,

crates/ruff/src/rules/flake8_bandit/snapshots/ruff__rules__flake8_bandit__tests__S112_S112.py.snap

@@ -22,4 +22,24 @@ expression: diagnostics
     column: 12
   fix: ~
   parent: ~
+- kind:
+    TryExceptContinue: ~
+  location:
+    row: 14
+    column: 4
+  end_location:
+    row: 14
+    column: 12
+  fix: ~
+  parent: ~
+- kind:
+    TryExceptContinue: ~
+  location:
+    row: 19
+    column: 4
+  end_location:
+    row: 19
+    column: 12
+  fix: ~
+  parent: ~