MerginMaps / python-api-client

83%

master: 83%

LAST BUILD ON BRANCH fix/qgis-plugin-security-b105

branch: fix/qgis-plugin-security-b105

CHANGE BRANCH

x

Reset

Sync Branches

• fix/qgis-plugin-security-b105
• 0.10.0
• 0.10.1
• 0.10.2
• 0.10.3
• 0.10.5
• 0.12.0
• 0.12.1
• 0.12.2
• 0.12.3
• 0.12.4
• 0.13.0
• 0.13.1
• 0.13.2
• 0.13.3
• 0.14.0
• 0.14.1
• 0.9.0
• 0.9.1
• 0.9.2
• 0.9.3
• add-workspace-with-storage
• add_deps_on_syspath
• add_pathvalidate
• allow-mc-without-auth
• allow-mc-without-auth-explicitly
• auth_logging
• build
• build-test
• bump0134
• bump_0.13.0
• bump_0141
• bump_version0131
• bump_version0132
• bump_version_0134
• changes_limits
• cleanup-client-service
• copy_conflict_checksums
• create_invitation_method
• dependabot/github_actions/dot-github/workflows/actions/download-artifact-4.1.7
• download-project-temp-dir
• editor-filter-qgis-only
• editor-sync-handling
• extended-logging
• feat/releases-sync
• first-implementation-limit-overrides
• fix-changes-conn-close
• fix-changes-test
• fix-coveralls
• fix-error-handling-_do_request
• fix-jupyter-readme
• fix-logs-sending
• fix-missing-diffs-key
• fix-ssl-certificates
• fix-tests
• fix-tests-2025.4.1
• fix-typo-parsing
• fix-unfinished-pull-subfolders
• fix-upload-size-validation
• fix_compatible_typing
• fix_pygeodiff_import
• fix_server_type
• gh#214-versions-api-upgrade
• hotfix-access-token-structure
• improve-client-error
• increase-log-size
• independent_test_runs
• integrate-py-client-v2-project-version
• login-sso
• master
• monthlyContributorsError
• non_blocking_push
• notebooks-examples
• project-history
• project_id_type
• project_info_version
• pull-initial
• pull-temp-directory
• pull-to-temp-dir
• push-v2-integration
• pyapi_pipeline_checks
• python-37-tests
• qgis-security-scan
• remove-deprecated-lists
• revert-253-pull-to-temp-dir
• revert-monthly-contributor
• roles_as_string
• send-logs
• tables-to-include
• upgrade-geodiff
• upgrade-geodiff-211
• upgrade_geodiff_220
• v2-pull-integration
• v2_endpoints_for_user_and_access_management
• workspace-id

Build # 29726781903

Build Type

Pull #309

github

Committed by harminius

Commit Message

Fix plugins.qgis.org security-review findings

Rename token_prefix -> bearer_prefix in decode_token_data so the
"Bearer " scheme prefix no longer trips Bandit B105 (hardcoded
password) - a critical, non-waivable finding that auto-rejects the
bundled plugin on plugins.qgis.org.

Suppress the three internal asserts with "# nosec B101" so they do
not fail the review's Bandit check on a web upload.

Pull Request Pull Request #309: Fix plugins.qgis.org security-review findings

Coverage Stats

4 of 6 new or added lines in 3 files covered. (66.67%)

4731 of 5673 relevant lines covered (83.4%)

0.83 hits per line