[`flake8-bandit`] `S601` does not account for calls through clients

[MeGaGiGaGon]

Summary

I found this while working on #18972

paramiko-call (S601) only checks for a paramiko.exec_command, as seen in the test case:

ruff/crates/ruff_linter/resources/test/fixtures/flake8_bandit/S601.py

Lines 1 to 3 in 90cb0d3

	import paramiko
	paramiko.exec_command('something; really; unsafe')

And the given example code does not raise: https://play.ruff.rs/6b4aa322-f3b1-49cd-997d-f14b5c1bac41

However, as both the example in S601's docs show, and on paramiko's docs, this call can also be done through an intermediary client object:

client = SSHClient()
client.load_system_host_keys()
client.connect('ssh.example.com')
stdin, stdout, stderr = client.exec_command('ls -l')

The rule needs to either be more general like how suspicious-subprocess-import (S404) is a blanket search for importing subprocess, or have additional cases added, since reading through the paramiko docs it looks like exec_command is just a convenience wrapper around functionality provided in the Client object, which would share the same security concerns. I'm also not certain paramiko.exec_command is even valid code using paramiko, as a github search for "paramiko.exec_command" only returned it in flake8-bandit/ruff test cases.

Version

playground

[ntBre]

I think this makes sense and is arguably a bug in the rule. We only check for the qualified path paramiko.exec_command, as you said:

ruff/crates/ruff_linter/src/rules/flake8_bandit/rules/paramiko_calls.rs

Lines 41 to 46 in db3dcd8

	if checker
	.semantic()
	.resolve_qualified_name(func)
	.is_some_and(|qualified_name| {
	matches!(qualified_name.segments(), ["paramiko", "exec_command"])
	})

whereas I think upstream is checking for any call named exec_command if paramiko has been imported:

https://github.com/PyCQA/bandit/blob/ffed1bbf0adb2d259005aca6da506e86a291c987/bandit/plugins/injection_paramiko.py#L56-L58

I think we could try to resolve the call through a Client, at least within a single file.

[CodeMan62]

I am fixing it