Description: Python 3.14 compat
Author: Thomas Goirand <zigo@debian.org>
Bug-Debian: https://bugs.debian.org/1123378
Forwarded: no
Last-Update: 2025-12-29

Index: bandit/bandit/core/context.py
===================================================================
--- bandit.orig/bandit/core/context.py
+++ bandit/bandit/core/context.py
@@ -3,6 +3,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 import ast
+import sys
 
 from bandit.core import utils
 
@@ -173,55 +174,46 @@ class Context:
         return defaults
 
     def _get_literal_value(self, literal):
-        """Utility function to turn AST literals into native Python types
+        """Get the value of a literal AST node.
 
         :param literal: The AST literal to convert
         :return: The value of the AST literal
         """
-        if isinstance(literal, ast.Num):
-            literal_value = literal.n
-
-        elif isinstance(literal, ast.Str):
-            literal_value = literal.s
-
-        elif isinstance(literal, ast.List):
-            return_list = list()
-            for li in literal.elts:
-                return_list.append(self._get_literal_value(li))
-            literal_value = return_list
-
-        elif isinstance(literal, ast.Tuple):
-            return_tuple = tuple()
-            for ti in literal.elts:
-                return_tuple += (self._get_literal_value(ti),)
-            literal_value = return_tuple
-
-        elif isinstance(literal, ast.Set):
-            return_set = set()
-            for si in literal.elts:
-                return_set.add(self._get_literal_value(si))
-            literal_value = return_set
-
-        elif isinstance(literal, ast.Dict):
-            literal_value = dict(zip(literal.keys, literal.values))
-
-        elif isinstance(literal, ast.Ellipsis):
-            # what do we want to do with this?
-            literal_value = None
-
-        elif isinstance(literal, ast.Name):
-            literal_value = literal.id
-
-        elif isinstance(literal, ast.NameConstant):
-            literal_value = str(literal.value)
-
-        elif isinstance(literal, ast.Bytes):
-            literal_value = literal.s
-
+        # Python 3.14+ unified literals under ast.Constant
+        if sys.version_info >= (3, 14):
+            if isinstance(literal, ast.Constant):
+                if literal.value is Ellipsis:
+                    return None
+                return literal.value
         else:
-            literal_value = None
+            if isinstance(literal, ast.Num):
+                return literal.n
+            if isinstance(literal, ast.Str):
+                return literal.s
+            if isinstance(literal, ast.Bytes):
+                return literal.s
+            if isinstance(literal, ast.NameConstant):
+                return literal.value
+
+        if isinstance(literal, ast.List):
+            return [self._get_literal_value(li) for li in literal.elts]
+
+        if isinstance(literal, ast.Tuple):
+            return tuple(self._get_literal_value(ti) for ti in literal.elts)
+
+        if isinstance(literal, ast.Set):
+            return {self._get_literal_value(si) for si in literal.elts}
+
+        if isinstance(literal, ast.Dict):
+            return {
+                self._get_literal_value(k): self._get_literal_value(v)
+                for k, v in zip(literal.keys, literal.values)
+            }
 
-        return literal_value
+        if isinstance(literal, ast.Name):
+            return literal.id
+
+        return None
 
     def get_call_arg_value(self, argument_name):
         """Gets the value of a named argument in a function call.
Index: bandit/bandit/core/utils.py
===================================================================
--- bandit.orig/bandit/core/utils.py
+++ bandit/bandit/core/utils.py
@@ -360,6 +360,18 @@ def parse_ini_file(f_loc):
 
 def check_ast_node(name):
     "Check if the given name is that of a valid AST node."
+
+    # Map old AST node names to new ones in Python 3.14+
+    if sys.version_info >= (3, 14):
+        legacy_map = {
+            "Str": "Constant",
+            "Num": "Constant",
+            "Bytes": "Constant",
+            "NameConstant": "Constant",
+            "Ellipsis": "Ellipsis",
+        }
+        name = legacy_map.get(name, name)
+
     try:
         node = getattr(ast, name)
         if issubclass(node, ast.AST):
Index: bandit/tests/unit/core/test_context.py
===================================================================
--- bandit.orig/tests/unit/core/test_context.py
+++ bandit/tests/unit/core/test_context.py
@@ -4,12 +4,48 @@
 # SPDX-License-Identifier: Apache-2.0
 import ast
 from unittest import mock
+import sys
 
 import testtools
 
 from bandit.core import context
 
 
+def make_str(s):
+    if sys.version_info >= (3, 14):
+        return ast.Constant(s)
+    return ast.Str(s)
+
+def make_num(n):
+    if sys.version_info >= (3, 14):
+        return ast.Constant(n)
+    return ast.Num(n)
+
+def make_bytes(b):
+    if sys.version_info >= (3, 14):
+        return ast.Constant(b)
+    return ast.Bytes(b)
+
+def literal_value(node):
+    """Return the actual value of an AST literal node, handling Python 3.14+"""
+    if isinstance(node, ast.Constant):
+        return node.value
+
+    if hasattr(ast, "Num") and isinstance(node, ast.Num):
+        return node.n
+    if hasattr(ast, "Str") and isinstance(node, ast.Str):
+        return node.s
+    if hasattr(ast, "Bytes") and isinstance(node, ast.Bytes):
+        return node.s
+    if hasattr(ast, "NameConstant") and isinstance(node, ast.NameConstant):
+        return node.value
+
+    if isinstance(node, ast.Name):
+        return node.id
+
+    return None
+
+
 class ContextTests(testtools.TestCase):
     def test_context_create(self):
         ref_context = mock.Mock()
@@ -132,39 +168,44 @@ class ContextTests(testtools.TestCase):
     def test__get_literal_value(self):
         new_context = context.Context()
 
-        value = ast.Num(42)
-        expected = value.n
+        value = make_num(42)
+        expected = literal_value(value)
         self.assertEqual(expected, new_context._get_literal_value(value))
 
-        value = ast.Str("spam")
-        expected = value.s
+        value = make_str("spam")
+        expected = literal_value(value)
         self.assertEqual(expected, new_context._get_literal_value(value))
 
-        value = ast.List([ast.Str("spam"), ast.Num(42)], ast.Load())
-        expected = [ast.Str("spam").s, ast.Num(42).n]
+        value = ast.List([make_str("spam"), make_num(42)], ast.Load())
+        expected = [literal_value(x) for x in value.elts]
         self.assertListEqual(expected, new_context._get_literal_value(value))
 
-        value = ast.Tuple([ast.Str("spam"), ast.Num(42)], ast.Load())
-        expected = (ast.Str("spam").s, ast.Num(42).n)
+        value = ast.Tuple([make_str("spam"), make_num(42)], ast.Load())
+        expected = tuple(literal_value(x) for x in value.elts)
         self.assertTupleEqual(expected, new_context._get_literal_value(value))
 
-        value = ast.Set([ast.Str("spam"), ast.Num(42)])
-        expected = {ast.Str("spam").s, ast.Num(42).n}
+        value = ast.Set([make_str("spam"), make_num(42)])
+        expected = {literal_value(x) for x in value.elts}
         self.assertSetEqual(expected, new_context._get_literal_value(value))
 
-        value = ast.Dict(["spam", "eggs"], [42, "foo"])
-        expected = dict(spam=42, eggs="foo")
+        value = ast.Dict([make_str("spam"), make_str("eggs")],
+                         [make_num(42), make_str("foo")])
+        expected = {literal_value(k): literal_value(v) for k, v in zip(value.keys, value.values)}
         self.assertDictEqual(expected, new_context._get_literal_value(value))
 
-        value = ast.Ellipsis()
-        self.assertIsNone(new_context._get_literal_value(value))
+        if sys.version_info >= (3, 14):
+            value = ast.Constant(Ellipsis)
+        else:
+            value = ast.Ellipsis()
+
+        self.assertEqual(None, new_context._get_literal_value(value))
 
         value = ast.Name("spam", ast.Load())
-        expected = value.id
+        expected = literal_value(value)
         self.assertEqual(expected, new_context._get_literal_value(value))
 
-        value = ast.Bytes(b"spam")
-        expected = value.s
+        value = make_bytes(b"spam")
+        expected = literal_value(value)
         self.assertEqual(expected, new_context._get_literal_value(value))
 
         self.assertIsNone(new_context._get_literal_value(None))
@@ -207,7 +248,7 @@ class ContextTests(testtools.TestCase):
     def test_get_call_arg_at_position(self):
         expected_arg = "spam"
         ref_call = mock.Mock()
-        ref_call.args = [ast.Str(expected_arg)]
+        ref_call.args = [make_str(expected_arg)]
         ref_context = dict(call=ref_call)
         new_context = context.Context(context_object=ref_context)
         self.assertEqual(expected_arg, new_context.get_call_arg_at_position(0))
Index: bandit/tests/unit/core/test_test_set.py
===================================================================
--- bandit.orig/tests/unit/core/test_test_set.py
+++ bandit/tests/unit/core/test_test_set.py
@@ -3,6 +3,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 from unittest import mock
+import sys
 
 import testtools
 from stevedore import extension
@@ -14,6 +15,8 @@ from bandit.core import test_properties
 from bandit.core import test_set
 
 
+AST_STR = "Str" if sys.version_info < (3, 14) else "Constant"
+
 @test.checks("Str")
 @test.test_id("B000")
 def test_plugin():
@@ -67,27 +70,27 @@ class BanditTestSetTests(testtools.TestC
 
     def test_has_defaults(self):
         ts = test_set.BanditTestSet(self.config)
-        self.assertEqual(1, len(ts.get_tests("Str")))
+        self.assertEqual(1, len(ts.get_tests(AST_STR)))
 
     def test_profile_include_id(self):
         profile = {"include": ["B000"]}
         ts = test_set.BanditTestSet(self.config, profile)
-        self.assertEqual(1, len(ts.get_tests("Str")))
+        self.assertEqual(1, len(ts.get_tests(AST_STR)))
 
     def test_profile_exclude_id(self):
         profile = {"exclude": ["B000"]}
         ts = test_set.BanditTestSet(self.config, profile)
-        self.assertEqual(0, len(ts.get_tests("Str")))
+        self.assertEqual(0, len(ts.get_tests(AST_STR)))
 
     def test_profile_include_none(self):
         profile = {"include": []}  # same as no include
         ts = test_set.BanditTestSet(self.config, profile)
-        self.assertEqual(1, len(ts.get_tests("Str")))
+        self.assertEqual(1, len(ts.get_tests(AST_STR)))
 
     def test_profile_exclude_none(self):
         profile = {"exclude": []}  # same as no exclude
         ts = test_set.BanditTestSet(self.config, profile)
-        self.assertEqual(1, len(ts.get_tests("Str")))
+        self.assertEqual(1, len(ts.get_tests(AST_STR)))
 
     def test_profile_has_builtin_blacklist(self):
         ts = test_set.BanditTestSet(self.config)