B703 and B308 check passed if mark_safe used as a decorator
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 835
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
According to docs mark_safe can also be used as a decorator.
B703 and B308 checks in this case passed.
To Reproduce
When mark_safe used as a function:
example.py
from django.utils.safestring import mark_safe
def foo(a):
return mark_safe(a)
Output
bandit example.py
[main] INFO profile include tests: None
[main] INFO profile exclude tests: None
[main] INFO cli include tests: None
[main] INFO cli exclude tests: None
[main] INFO running on Python 3.7.5
[node_visitor] INFO Unable to find qualified name for module: example.py
Run started:2020-03-25 14:34:46.110414
Test results:
>> Issue: [B703:django_mark_safe] Potential XSS on mark_safe function.
Severity: Medium Confidence: High
Location: example.py:5
More Info: https://bandit.readthedocs.io/en/latest/plugins/b703_django_mark_safe.html
4 def foo(a):
5 return mark_safe(a)
--------------------------------------------------
>> Issue: [B308:blacklist] Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
Severity: Medium Confidence: High
Location: example.py:5
More Info: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b308-mark-safe
4 def foo(a):
5 return mark_safe(a)
--------------------------------------------------
Code scanned:
Total lines of code: 3
Total lines skipped (#nosec): 0
Run metrics:
Total issues (by severity):
Undefined: 0.0
Low: 0.0
Medium: 2.0
High: 0.0
Total issues (by confidence):
Undefined: 0.0
Low: 0.0
Medium: 0.0
High: 2.0
Files skipped (0):
When as a decorator
example.py
from django.utils.safestring import mark_safe
@mark_safe
def foo(a):
return a
Output
bandit example.py
[main] INFO profile include tests: None
[main] INFO profile exclude tests: None
[main] INFO cli include tests: None
[main] INFO cli exclude tests: None
[main] INFO running on Python 3.7.5
[node_visitor] INFO Unable to find qualified name for module: example.py
Run started:2020-03-25 14:35:07.494061
Test results:
No issues identified.
Code scanned:
Total lines of code: 4
Total lines skipped (#nosec): 0
Run metrics:
Total issues (by severity):
Undefined: 0.0
Low: 0.0
Medium: 0.0
High: 0.0
Total issues (by confidence):
Undefined: 0.0
Low: 0.0
Medium: 0.0
High: 0.0
Files skipped (0):
Expected behavior
Same issues should be shown.
Bandit version
bandit 1.6.2
python version = 3.7.6 (default, Jan 18 2020, 02:49:59) [GCC 9.2.0]
Additional context
I like this tool :)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the B703 and B308 check implementations and their existing tests. Reproduce the reported @mark_safe example alongside the function-call example, then run the relevant Bandit test suite. Done means the decorator form receives the same findings as the direct call without regressing existing checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- django, python
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100