Skip to content

Remove lxml (B320 & B410) from blacklist #1212

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ericwb merged 4 commits into from
Jan 7, 2025
Merged

Remove lxml (B320 & B410) from blacklist #1212

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
19c5f09
remove B320 (xml_bad_etree) and B410 (import_lxml)
djbrown Dec 19, 2024
7b71505
restore lxml documentation and denote removal
djbrown Dec 28, 2024
50ab30a
fix missing newline
djbrown Dec 28, 2024
ccded51
Merge branch 'main' into lxml-guidance
ericwb Jan 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 11 additions & 21 deletions bandit/blacklists/calls.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,7 +219,7 @@
| B312 | telnetlib | - telnetlib.\* | High |
+------+---------------------+------------------------------------+-----------+

B313 - B320: XML
B313 - B319: XML
----------------

Most of this is based off of Christian Heimes' work on defusedxml:
Expand Down Expand Up @@ -256,6 +256,15 @@
| B319 | xml_bad_pulldom | - xml.dom.pulldom.parse | Medium |
| | | - xml.dom.pulldom.parseString | |
+------+---------------------+------------------------------------+-----------+

B320: xml_bad_etree
-------------------

The check for this call has been removed.

+------+---------------------+------------------------------------+-----------+
| ID | Name | Calls | Severity |
+======+=====================+====================================+===========+
| B320 | xml_bad_etree | - lxml.etree.parse | Medium |
| | | - lxml.etree.fromstring | |
| | | - lxml.etree.RestrictedElement | |
Expand Down Expand Up @@ -615,26 +624,7 @@ def gen_blacklist():
)
)

sets.append(
utils.build_conf_dict(
"xml_bad_etree",
"B320",
issue.Cwe.IMPROPER_INPUT_VALIDATION,
[
"lxml.etree.parse",
"lxml.etree.fromstring",
"lxml.etree.RestrictedElement",
"lxml.etree.GlobalParserTLS",
"lxml.etree.getDefaultParser",
"lxml.etree.check_docinfo",
],
(
"Using {name} to parse untrusted XML data is known to be "
"vulnerable to XML attacks. Replace {name} with its "
"defusedxml equivalent function."
),
)
)
# skipped B320 as the check for a call to lxml.etree has been removed

# end of XML tests

Expand Down
18 changes: 3 additions & 15 deletions bandit/blacklists/imports.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,8 @@

B410: import_lxml
-----------------
This import blacklist has been removed. The information here has been
left for historical purposes.

Using various methods to parse untrusted XML data is known to be vulnerable to
XML attacks. Replace vulnerable imports with the equivalent defusedxml package.
Expand Down Expand Up @@ -297,11 +299,6 @@ def gen_blacklist():
"defusedxml package, or make sure defusedxml.defuse_stdlib() "
"is called."
)
lxml_msg = (
"Using {name} to parse untrusted XML data is known to be "
"vulnerable to XML attacks. Replace {name} with the "
"equivalent defusedxml package."
)

sets.append(
utils.build_conf_dict(
Expand Down Expand Up @@ -358,16 +355,7 @@ def gen_blacklist():
)
)

sets.append(
utils.build_conf_dict(
"import_lxml",
"B410",
issue.Cwe.IMPROPER_INPUT_VALIDATION,
["lxml"],
lxml_msg,
"LOW",
)
)
# skipped B410 as the check for import_lxml has been removed

sets.append(
utils.build_conf_dict(
Expand Down
9 changes: 0 additions & 9 deletions examples/xml_lxml.py
View file
Open in desktop

This file was deleted.

6 changes: 0 additions & 6 deletions tests/functional/test_functional.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -556,12 +556,6 @@ def test_xml(self):
}
self.check_example("xml_expatbuilder.py", expect)

expect = {
"SEVERITY": {"UNDEFINED": 0, "LOW": 3, "MEDIUM": 1, "HIGH": 0},
"CONFIDENCE": {"UNDEFINED": 0, "LOW": 0, "MEDIUM": 0, "HIGH": 4},
}
self.check_example("xml_lxml.py", expect)

expect = {
"SEVERITY": {"UNDEFINED": 0, "LOW": 2, "MEDIUM": 2, "HIGH": 0},
"CONFIDENCE": {"UNDEFINED": 0, "LOW": 0, "MEDIUM": 0, "HIGH": 4},
Expand Down