xml.sax.saxutils.escape and quoteattr incorrectly flagged as insecure
Open
Nobody has claimed this yet.
bug
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 835
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
from xml.sax.saxutils import escape
from xml.sax.saxutils import quoteattr
Are flagged as Severity: Low Confidence: High. Instructions are to use the equivalent defusedxml package.
- I do not believe these imports to be insecure as they are simple text substitutions.
- There is no defusedxml equivalent.
Expected behavior
Do not mark escape and quoteattr as vulnerable.
Bandit version
bandit 1.5.1
python version = 3.6.3 (default, Apr 26 2018, 13:16:02) [GCC 4.4.7 20120313 (Red Hat 4.4.7-18)]
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Bandit check that flags imports of xml.sax.saxutils.escape and quoteattr. Reproduce the report with the minimal imports shown, then confirm that neither import is marked vulnerable and add or update coverage if the relevant check has tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100