False negative: B104 misses `bind(("", port))` wildcard host

[9iang22]

Describe the bug

B104 currently detects hardcoded wildcard binds when the host literal is "0.0.0.0", but it misses the equivalent Python socket form "".
In Python, socket.bind(("", port)) binds to all available interfaces (INADDR_ANY), which has the same exposure risk as "0.0.0.0".

Reproduction steps

import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(("", 31137))

Expected behavior

Bandit should report B104: hardcoded_bind_all_interfaces for this case

Bandit version

1.9.1 (Default)

Python version

3.14 (Default)

Additional context

No response

[ericwb]

It is true that the empty string defaults to 0.0.0.0 when passed to certain functions such as socket.bind. However, to fix, you need to match the function call with the argument.