-
-
Notifications
You must be signed in to change notification settings - Fork 731
Closed
Labels
bugSomething isn't workingSomething isn't working
Description
Describe the bug
The message for B410 ("Using lxml.cssselect to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.cssselect with the equivalent defusedxml package.") is misleading: There is no equivalent in the defusedxml package. According to https://github.com/tiran/defusedxml/blob/9ca12a2cd3faf4554b30ac7d380a4ea393469c72/defusedxml/lxml.py#L26-L29 defusedxml.lxml is deprecated and to be be removed.
To Reproduce
Steps to reproduce the behavior:
- Have a Python module containing
import lxml.cssselect. - Run
banditon it - See error message
Expected behavior
No message should be shown.
Bandit version
bandit 1.7.0
python version = 3.8.10 (default, May 7 2021, 21:09:28) [Clang 12.0.5 (clang-1205.0.22.9)]
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working