Add bandit security checks and fix B615 HuggingFace unsafe download warnings

[Copilot]

Adds bandit to CI and resolves all B615 (HuggingFace unsafe download without revision pinning) findings across the codebase. Also moves B202, B310, B311, B614, B105, and B107 suppressions from the global skips list to location-specific # nosec comments. Adds # NOSONAR to all pseudo-random call sites to suppress SonarQube S2245 warnings.

What do these changes do

• Adds bandit>=1.9.4 to dev dependencies and a [tool.bandit] config section in pyproject.toml
• Adds .github/workflows/bandit.yml CI workflow running bandit -r pythainlp -c pyproject.toml on push/PR to dev and main
• Adds revision: Optional[str] = None parameter to 12 model-loading functions so callers can pin to a commit hash
• Adds # nosec B615 to 13 call sites where hardcoded well-known model names are loaded at module level (parameterization impractical)
• Removes B615 from the global skips list — bandit now enforces it
• Moves B202, B310, B311, B614, B105, and B107 from the global skips list to location-specific # nosec BXXX comments at each call site; only B110 (try/except/pass structural pattern) remains in the global skips list
• Adds # NOSONAR to all 14 random.* call sites across 7 files to suppress SonarQube S2245 (pseudo-random number generator) warnings

What was wrong

HuggingFace from_pretrained(), hf_hub_download(), and snapshot_download() calls throughout the codebase had no revision parameter, meaning models are always fetched from the mutable tip of the default branch. This is flagged as CWE-494 (download of code without integrity check).

Additionally, B202, B310, B311, B614, B105, and B107 were suppressed globally via the skips list, making the suppressions invisible and unenforced at the relevant call sites.

The # nosec B311 (Bandit) and # noqa: S311 (Ruff/Flake8) comments at pseudo-random call sites do not suppress SonarQube warnings; SonarQube requires its own # NOSONAR token.

How this fixes it

For functions that accept a user-supplied model name, a revision parameter is threaded through to the underlying HuggingFace call. Bandit's B615 check passes when revision= is bound to a non-constant expression (a variable), even when the default is None. Callers can now pin to a full commit SHA for reproducible, tamper-evident downloads:

# Pin to a specific commit for reproducible, secure downloads
get_hf_hub("airesearch/wangchanberta-base-att-spm-uncased",
           revision="a3b4c5d...")

# Or omit for previous behaviour (latest)
get_hf_hub("airesearch/wangchanberta-base-att-spm-uncased")

For module-level singletons with hardcoded model names (e.g., phayathaibert/core.py, spell/wanchanberta_thai_grammarly.py), # nosec B615 is used since the model identity is fixed in the source.

For the remaining rules, suppressions are now co-located with the code they apply to:

• B310 (urlopen): two call sites in corpus/core.py, both using HTTPS with SSL verification enabled
• B202 (extractall): tar.extractall() and zip_file.extractall() in corpus/core.py, each preceded by explicit path-traversal validation
• B311 (pseudo-random): 14 random.* call sites across 7 files — all non-security NLP uses; each line now carries # noqa: S311 # nosec B311 # NOSONAR to suppress Ruff, Bandit, and SonarQube respectively
• B614 (torch.load): two call sites in transliterate/thai2rom.py and transliterate/thaig2p.py, loading trusted internal corpus model files
• B105 (hardcoded password string): generate/thai2fit.py ("pad_token": 1 config value) and tokenize/_utils.py (empty string accumulator)
• B107 (hardcoded password default): phayathaibert/core.py (space_token default) and translate/tokenization_small100.py (tokenizer special tokens such as <s>, </s>, <pad>, <unk>)

Your checklist for this pull request

• Passed code styles and structures
• Passed code linting checks and unit test

[bact]

@copilot

When possible the B202, B310, B311, and B614 exceptions should be a location-specific exception, not a catch-all exception at the configuration level.

[Copilot]

@copilot

When possible the B202, B310, B311, and B614 exceptions should be a location-specific exception, not a catch-all exception at the configuration level.

Done. B202, B310, B311, and B614 have been removed from the global skips list in pyproject.toml and replaced with location-specific # nosec BXXX comments at each call site:

• B310: two urlopen(...) calls in corpus/core.py
• B202: tar.extractall(...) and zip_file.extractall(...) in corpus/core.py
• B311: all random.* calls across augment/lm/phayathaibert.py, generate/core.py, generate/thai2fit.py, phayathaibert/core.py, tools/misspell.py, transliterate/thai2rom.py, and transliterate/thaig2p.py
• B614: two torch.load(...) calls in transliterate/thai2rom.py and transliterate/thaig2p.py

Bandit now reports zero issues with 33 location-specific suppressions tracked. Commit: Move B202/B310/B311/B614 from global skips to location-specific nosec comments

[bact]

@copilot The Bandit B105 and B107 exceptions should be location-specific too when possible.

[Copilot]

@copilot The Bandit B105 and B107 exceptions should be location-specific too when possible.

Done. B105 and B107 have been removed from the global skips list and replaced with location-specific # nosec comments:

• B105: generate/thai2fit.py line 100 ("pad_token": 1), tokenize/_utils.py line 59 (empty string accumulator)
• B107: phayathaibert/core.py line 123 (space_token: str = "<_>"), translate/tokenization_small100.py lines 152–156 (tokenizer special tokens <s>, </s>, <pad>, <unk>)

The global skips list now only retains B110 (try/except/pass), which is a broad structural pattern not tied to individual call sites.

[bact]

@copilot SonarQube scan still warns about 2 locations of pseudo random number generator. Looks like the # noqa: S311 # nosec B311 comment is not enough? How to silenced it?

[Copilot]

@copilot SonarQube scan still warns about 2 locations of pseudo random number generator. Looks like the # noqa: S311 # nosec B311 comment is not enough? How to silenced it?

SonarQube uses # NOSONAR for inline suppression — # nosec is Bandit-only and # noqa is Ruff/Flake8-only; SonarQube ignores both. Added # NOSONAR to all 14 random.* call sites across transliterate/thai2rom.py, transliterate/thaig2p.py, phayathaibert/core.py, augment/lm/phayathaibert.py, generate/core.py, generate/thai2fit.py, and tools/misspell.py. Commit: Add # NOSONAR to all pseudo-random call sites to silence SonarQube S2245 warnings

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.9% Duplication on New Code

See analysis details on SonarQube Cloud