from xml.etree.ElementTree import Element Flagged
Open
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 835
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
from xml.etree.ElementTree import Element
Is flagged as Severity: Low and Confidence: High. Solution advises to use defusedxml, except the defusedxml package does not contain Element.
Expected behavior
Do not mark Element as vulnerable.
Bandit version
bandit 1.6.2
python version = 3.6.10 |Anaconda, Inc.| (default, Mar 25 2020, 23:51:54) [GCC 7.3.0]
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The report names the Python import and Bandit 1.6.2 but no source file or test. Reproduce the finding, then locate the check that flags Element and its related tests; done means this import is no longer reported as vulnerable while other affected cases remain covered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100