Skip to content

complaining the feature that i am not using in the python library #1164

Open
@r4m4k0735w4r4r40

Description

Describe the bug

I am using the below imports to construct the XML but I am not parsing the XML with the any of the below module or sub module but still bandit it complaining( CWE-20) that do not use those module or sub modules to parse the XML. I think it will be good to raise the warning if the feature is used.

import i am using
from xml.etree.ElementTree import Element, SubElement, tostring

Reproduction steps

Create test.py and add below code

import xml.etree.ElementTree as et

root = et.Element("user")
name = et.SubElement(root, "name")
name.text = "John Doe"
email = et.SubElement(root, "email")
email.text = "john@example.com"
tree = et.ElementTree(root)
a = et.tostring(root).decode("utf-8")
print(a)

Then run the bandit scan

Expected behavior

I think it will be good to raise the warning if the feature is used.

Bandit version

1.7.9 (Default)

Python version

3.9

Additional context

image

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions