B314 since Python 3.6 is not valid
Open
Nobody has claimed this yet.
bug
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 836
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
I checked the python module xml processing and the vulns that bandit report is no longer there. maybe you should remove it:
- xml.etree.ElementTree.parse
- xml.etree.ElementTree.iterparse
- xml.etree.ElementTree.fromstring
- xml.etree.ElementTree.XMLParser
https://docs.python.org/3/library/xml.html#xml-vulnerabilities
I also checked billion laughs and quadratic blowup no longer there even the doc above said so.
Reproduction steps
- Using xml.etree
import xml.etree.ElementTree as ET
import xml as xml
tree = ET.parse('country_data.xml')
print(tree.findtext('body'))
output:
>> Issue: [B314:blacklist] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
Severity: Medium Confidence: High
CWE: CWE-20 (https://cwe.mitre.org/data/definitions/20.html)
More Info: https://bandit.readthedocs.io/en/1.7.5/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree
Location: main.py:5:7
4
5 tree = ET.parse('country_data.xml')
6 print(tree.findtext('body'))
Expected behavior
Maybe remove [B314] or explain your concern there.
Bandit version
1.7.5 (Default)
Python version
3.11
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the B314 blacklist rule and its related tests, then review the listed xml.etree.ElementTree calls against the linked Python XML vulnerability documentation. Confirm whether the reported warning is still accurate for Python 3.11, and consider the issue complete when the rule or its explanation and tests reflect the verified behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100