Ignore empty string for S105/S106/S107

[ngnpope]

Using v0.0.237 I get: S105 Possible hardcoded password: ""

This was in some code that was checking whether a password/secret matched the empty string, i.e. if secret == "".

I think we want to ignore any comparisons to "" (or None if that's not already handled) for S105, S106, and S107.

[charliermarsh]

I'm tempted to follow bandit here even if it's not totally ideal. (Not sure what their exact behavior is for this.)

[ngnpope]

So I checked, see #2384 (comment), and bandit doesn't ignore empty string.

While I was being thorough, I checked what happens if we have a byte string, e.g. password = b"shh, don't tell anyone!" and neither ruff, nor bandit complain. Wondering if they should? 🤔

[charliermarsh]

Yeah maybe we should ignore "" at least.

[charliermarsh]

I'll call it a "bug", even though it's really a refinement :)