[fix] Small bandit changes (#3241)

lnbits/core/migrations.py

@@ -248,7 +248,8 @@ async def m007_set_invoice_expiries(db: Connection):
                     """,
                     {"expiry": expiration_date, "checking_id": checking_id},
                 )
-            except Exception:
+            except Exception as exc:
+                logger.debug(exc)
                 continue
     except OperationalError:
         # this is necessary now because it may be the case that this migration will
@@ -371,7 +372,8 @@ async def m014_set_deleted_wallets(db: Connection):
                         "wallet": row.get("id"),
                     },
                 )
-            except Exception:
+            except Exception as exc:
+                logger.debug(exc)
                 continue
     except OperationalError:
         # this is necessary now because it may be the case that this migration will

lnbits/core/services/lnurl.py

@@ -67,16 +67,16 @@ async def redeem_lnurl_withdraw(
             external=True,
             wal=wallet_id,
         )
-    except Exception:
-        pass
+    except Exception as exc:
+        logger.debug(exc)
 
     headers = {"User-Agent": settings.user_agent}
     async with httpx.AsyncClient(headers=headers) as client:
         try:
             check_callback_url(res["callback"])
             await client.get(res["callback"], params=params)
-        except Exception:
-            pass
+        except Exception as exc:
+            logger.debug(exc)
 
 
 async def perform_lnurlauth(

lnbits/core/views/auth_api.py

@@ -557,8 +557,8 @@ def _find_auth_provider_class(provider: str) -> Callable:
             provider_class = getattr(provider_module, f"{provider.title()}SSO")
             if provider_class:
                 return provider_class
-        except Exception:
-            pass
+        except Exception as exc:
+            logger.debug(exc)
 
     raise ValueError(f"No SSO provider found for '{provider}'.")
 

lnbits/helpers.py

@@ -306,8 +306,11 @@ def check_callback_url(url: str):
     )
 
 
-def download_url(url, save_path):
-    with request.urlopen(url, timeout=60) as dl_file:
+def download_url(url: str, save_path: Path):
+    if not url.startswith(("http:", "https:")):
+        raise ValueError(f"Invalid URL: {url}. Must start with 'http' or 'https'.")
+
+    with request.urlopen(url, timeout=60) as dl_file:  # noqa: S310
         with open(save_path, "wb") as out_file:
             out_file.write(dl_file.read())
 

lnbits/settings.py

@@ -683,7 +683,7 @@ class NodeUISettings(LNbitsSettings):
 
 class AuthMethods(Enum):
     user_id_only = "user-id-only"
-    username_and_password = "username-password"
+    username_and_password = "username-password"  # noqa: S105
     nostr_auth_nip98 = "nostr-auth-nip98"
     google_auth = "google-auth"
     github_auth = "github-auth"

lnbits/wallets/breez.py

@@ -57,8 +57,8 @@ else:
             # else convert from base64
             try:
                 return base64.b64decode(source)
-            except Exception:
-                pass
+            except Exception as exc:
+                logger.debug(exc)
         return None
 
     def load_greenlight_credentials() -> (

lnbits/wallets/cliche.py

@@ -182,7 +182,8 @@ class ClicheWallet(Wallet):
                     try:
                         if data["result"]["status"]:
                             yield data["result"]["payment_hash"]
-                    except Exception:
+                    except Exception as exc:
+                        logger.debug(exc)
                         continue
             except Exception as exc:
                 logger.error(

lnbits/wallets/corelightning.py

@@ -1,6 +1,6 @@
 import asyncio
-import random
 from collections.abc import AsyncGenerator
+from secrets import token_urlsafe
 from typing import Any, Optional
 
 from bolt11.decode import decode as bolt11_decode
@@ -92,7 +92,7 @@ class CoreLightningWallet(Wallet):
         unhashed_description: Optional[bytes] = None,
         **kwargs,
     ) -> InvoiceResponse:
-        label = kwargs.get("label", f"lbl{random.random()}")
+        label = kwargs.get("label", f"lbl{token_urlsafe(16)}")
         msat: int = int(amount * 1000)
         try:
             if description_hash and not unhashed_description:

lnbits/wallets/corelightningrest.py

@@ -1,7 +1,7 @@
 import asyncio
 import json
-import random
 from collections.abc import AsyncGenerator
+from secrets import token_urlsafe
 from typing import Optional
 
 import httpx
@@ -111,7 +111,7 @@ class CoreLightningRestWallet(Wallet):
         unhashed_description: Optional[bytes] = None,
         **kwargs,
     ) -> InvoiceResponse:
-        label = kwargs.get("label", f"lbl{random.random()}")
+        label = kwargs.get("label", f"lbl{token_urlsafe(16)}")
         data: dict = {
             "amount": amount * 1000,
             "description": memo,
@@ -298,7 +298,8 @@ class CoreLightningRestWallet(Wallet):
                             self.last_pay_index = inv["pay_index"]
                             if not paid:
                                 continue
-                        except Exception:
+                        except Exception as exc:
+                            logger.debug(exc)
                             continue
                         logger.trace(f"paid invoice: {inv}")
 

lnbits/wallets/lndrest.py

@@ -292,7 +292,8 @@ class LndRestWallet(Wallet):
                         )
                     else:
                         return PaymentPendingStatus()
-                except Exception:
+                except Exception as exc:
+                    logger.debug(exc)
                     continue
 
         return PaymentPendingStatus()
@@ -307,7 +308,8 @@ class LndRestWallet(Wallet):
                             inv = json.loads(line)["result"]
                             if not inv["settled"]:
                                 continue
-                        except Exception:
+                        except Exception as exc:
+                            logger.debug(exc)
                             continue
 
                         payment_hash = base64.b64decode(inv["r_hash"]).hex()

lnbits/wallets/lntips.py

@@ -173,11 +173,12 @@ class LnTipsWallet(Wallet):
                             inv = json.loads(data)
                             if not inv.get("payment_hash"):
                                 continue
-                        except Exception:
+                        except Exception as exc:
+                            logger.debug(exc)
                             continue
                         yield inv["payment_hash"]
-            except Exception:
-                pass
+            except Exception as exc:
+                logger.debug(exc)
 
             # do not sleep if the connection was active for more than 10s
             # since the backend is expected to drop the connection after 90s

lnbits/wallets/macaroon/macaroon.py

@@ -2,6 +2,8 @@ import base64
 from getpass import getpass
 from typing import Optional
 
+from loguru import logger
+
 from lnbits.utils.crypto import AESCipher
 
 
@@ -39,7 +41,7 @@ def load_macaroon(
     try:
         macaroon = base64.b64decode(macaroon).hex()
         return macaroon
-    except Exception:
-        pass
+    except Exception as exc:
+        logger.debug(exc)
 
     return macaroon

lnbits/wallets/nwc.py

@@ -390,7 +390,7 @@ class NWCConnection:
         n = max_length - len(subid)
         if n > 0:
             for _ in range(n):
-                subid += chars[random.randint(0, len(chars) - 1)]
+                subid += chars[random.randint(0, len(chars) - 1)]  # noqa: S311
         return subid
 
     async def _close_subscription_by_subid(

lnbits/wallets/spark.py

@@ -1,8 +1,8 @@
 import asyncio
 import hashlib
 import json
-import random
 from collections.abc import AsyncGenerator
+from secrets import token_urlsafe
 from typing import Optional
 
 import httpx
@@ -116,7 +116,7 @@ class SparkWallet(Wallet):
         unhashed_description: Optional[bytes] = None,
         **kwargs,
     ) -> InvoiceResponse:
-        label = f"lbs{random.random()}"
+        label = f"lbs{token_urlsafe(16)}"
         try:
             if description_hash:
                 r = await self.invoicewithdescriptionhash(