'NoneType' object has no attribute 'id'Traceback in django_mark_safe

[darakian]

Describe the bug
While running bandit 1.6.2 I get the following output

[tester]	ERROR	Bandit internal error running: django_mark_safe on file ./venv/lib/python3.7/site-packages/django/template/base.py at line 738: 'NoneType' object has no attribute 'id'Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/bandit/core/tester.py", line 64, in run_tests
    result = test(context)
  File "/usr/local/lib/python3.7/site-packages/bandit/plugins/django_xss.py", line 295, in django_mark_safe
    return check_risk(context.node)
  File "/usr/local/lib/python3.7/site-packages/bandit/plugins/django_xss.py", line 243, in check_risk
    secure = evaluate_var(xss_var, parent, node.lineno)
  File "/usr/local/lib/python3.7/site-packages/bandit/plugins/django_xss.py", line 123, in evaluate_var
    to = analyser.is_assigned(node)
  File "/usr/local/lib/python3.7/site-packages/bandit/plugins/django_xss.py", line 89, in is_assigned
    assigned.extend(self.is_assigned_in(node.body))
  File "/usr/local/lib/python3.7/site-packages/bandit/plugins/django_xss.py", line 33, in is_assigned_in
    new_assigned = self.is_assigned(ast_inst)
  File "/usr/local/lib/python3.7/site-packages/bandit/plugins/django_xss.py", line 90, in is_assigned
    assigned.extend(self.is_assigned_in(node.orelse))
  File "/usr/local/lib/python3.7/site-packages/bandit/plugins/django_xss.py", line 33, in is_assigned_in
    new_assigned = self.is_assigned(ast_inst)
  File "/usr/local/lib/python3.7/site-packages/bandit/plugins/django_xss.py", line 89, in is_assigned
    assigned.extend(self.is_assigned_in(node.body))
  File "/usr/local/lib/python3.7/site-packages/bandit/plugins/django_xss.py", line 33, in is_assigned_in
    new_assigned = self.is_assigned(ast_inst)
  File "/usr/local/lib/python3.7/site-packages/bandit/plugins/django_xss.py", line 65, in is_assigned
    if withitem.optional_vars.id == self.var_name.id:
AttributeError: 'NoneType' object has no attribute 'id'

Expected behavior
Not seeing a stack trace.

Bandit version

bandit 1.6.2
  python version = 3.7.6 (default, Dec 30 2019, 19:38:26) [Clang 11.0.0 (clang-1100.0.33.16)]

[lukehinds]

hi @darakian

can you let us know the exact args you use to call Bandit and if the project you are scanning is available, the github repo url please

[darakian]

Sure thing. First the args are -iii -lll with the full command looking like (in my case)

bandit -iii -lll venv/lib/python3.7/site-packages/django/template/base.py

The project is the django web framework and I'm using this file in particular
https://github.com/django/django/blob/stable/1.11.x/django/template/base.py

With some quick testing it looks like any combination of i's and l's cause the stack trace. This includes not having them ex.

bandit venv/lib/python3.7/site-packages/django/template/base.py

[jshields]

I am having this issue as well. I can't share the full example since it's part of a closed source codebase, but basically here's what's happening:
bandit 1.6.2
python 3.6.9

[tester]	ERROR	Bandit internal error running: django_mark_safe on file apps/redacted/admin/views.py at line 65: 'NoneType' object has no attribute 'id'Traceback (most recent call last):
  File "redacted_app_name/lib/python3.6/site-packages/bandit/core/tester.py", line 64, in run_tests
    result = test(context)
  File "redacted_app_name/lib/python3.6/site-packages/bandit/plugins/django_xss.py", line 295, in django_mark_safe
    return check_risk(context.node)
  File "redacted_app_name/lib/python3.6/site-packages/bandit/plugins/django_xss.py", line 243, in check_risk
    secure = evaluate_var(xss_var, parent, node.lineno)
  File "redacted_app_name/lib/python3.6/site-packages/bandit/plugins/django_xss.py", line 123, in evaluate_var
    to = analyser.is_assigned(node)
  File "redacted_app_name/lib/python3.6/site-packages/bandit/plugins/django_xss.py", line 89, in is_assigned
    assigned.extend(self.is_assigned_in(node.body))
  File "redacted_app_name/lib/python3.6/site-packages/bandit/plugins/django_xss.py", line 33, in is_assigned_in
    new_assigned = self.is_assigned(ast_inst)
  File "redacted_app_name/lib/python3.6/site-packages/bandit/plugins/django_xss.py", line 89, in is_assigned
    assigned.extend(self.is_assigned_in(node.body))
  File "redacted_app_name/lib/python3.6/site-packages/bandit/plugins/django_xss.py", line 33, in is_assigned_in
    new_assigned = self.is_assigned(ast_inst)
  File "redacted_app_name/lib/python3.6/site-packages/bandit/plugins/django_xss.py", line 65, in is_assigned
    if withitem.optional_vars.id == self.var_name.id:
AttributeError: 'NoneType' object has no attribute 'id'

The line has the issue:

msg = '<a href="{url}">{s}</a>'.format(url=redacted_name.admin_url(), s=redacted)
messages.info(request, mark_safe(msg))

Workaround is to move mark_safe onto the line where msg is defined:

msg = mark_safe('<a href="{url}">{s}</a>'.format(url=redacted_name.admin_url(), s=redacted))
messages.info(request, msg)

[lukehinds]

@ehooo I can see this is your code, do you mind taking a look?

[ericwb]

Fixed with #598