PyCQA / PyCQA/bandit

B703 and B308 check passed if mark_safe used as a decorator

Open
#592 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
835
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug
According to docs mark_safe can also be used as a decorator.

B703 and B308 checks in this case passed.

To Reproduce

When mark_safe used as a function:

example.py

from django.utils.safestring import mark_safe


def foo(a):
    return mark_safe(a)

Output

bandit example.py 
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.7.5
[node_visitor]	INFO	Unable to find qualified name for module: example.py
Run started:2020-03-25 14:34:46.110414

Test results:
>> Issue: [B703:django_mark_safe] Potential XSS on mark_safe function.
   Severity: Medium   Confidence: High
   Location: example.py:5
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b703_django_mark_safe.html
4	def foo(a):
5	    return mark_safe(a)

--------------------------------------------------
>> Issue: [B308:blacklist] Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
   Severity: Medium   Confidence: High
   Location: example.py:5
   More Info: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b308-mark-safe
4	def foo(a):
5	    return mark_safe(a)

--------------------------------------------------

Code scanned:
	Total lines of code: 3
	Total lines skipped (#nosec): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0.0
		Low: 0.0
		Medium: 2.0
		High: 0.0
	Total issues (by confidence):
		Undefined: 0.0
		Low: 0.0
		Medium: 0.0
		High: 2.0
Files skipped (0):

When as a decorator

example.py

from django.utils.safestring import mark_safe

@mark_safe
def foo(a):
    return a

Output

bandit example.py 
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.7.5
[node_visitor]	INFO	Unable to find qualified name for module: example.py
Run started:2020-03-25 14:35:07.494061

Test results:
	No issues identified.

Code scanned:
	Total lines of code: 4
	Total lines skipped (#nosec): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0.0
		Low: 0.0
		Medium: 0.0
		High: 0.0
	Total issues (by confidence):
		Undefined: 0.0
		Low: 0.0
		Medium: 0.0
		High: 0.0
Files skipped (0):

Expected behavior
Same issues should be shown.

Bandit version

bandit 1.6.2
  python version = 3.7.6 (default, Jan 18 2020, 02:49:59) [GCC 9.2.0]

Additional context
I like this tool :)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the B703 and B308 check implementations and their existing tests. Reproduce the reported @mark_safe example alongside the function-call example, then run the relevant Bandit test suite. Done means the decorator form receives the same findings as the direct call without regressing existing checks.

Written by the indexing model from the issue text.

Assessment

Tech stack
django, python
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.