PyCQA / PyCQA/bandit

B314 since Python 3.6 is not valid

Open
#1,074 5 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

I checked the python module xml processing and the vulns that bandit report is no longer there. maybe you should remove it:

Reproduction steps
  1. Using xml.etree
import xml.etree.ElementTree as ET
import xml as xml

tree = ET.parse('country_data.xml')
print(tree.findtext('body'))

output:

>> Issue: [B314:blacklist] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
   Severity: Medium   Confidence: High
   CWE: CWE-20 (https://cwe.mitre.org/data/definitions/20.html)
   More Info: https://bandit.readthedocs.io/en/1.7.5/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree
   Location: main.py:5:7
4
5       tree = ET.parse('country_data.xml')
6       print(tree.findtext('body'))
Expected behavior

Maybe remove [B314] or explain your concern there.

Bandit version

1.7.5 (Default)

Python version

3.11

Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the B314 blacklist rule and its related tests, then review the listed xml.etree.ElementTree calls against the linked Python XML vulnerability documentation. Confirm whether the reported warning is still accurate for Python 3.11, and consider the issue complete when the rule or its explanation and tests reflect the verified behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.