Incorrect documentation links

[roniemartinez]

Describe the bug
bandit CLI generates incorrect links

To Reproduce

1. Write code with lxml.etree.fromstring call and run bandit CLI
2. Verify that the output link/reference in command line is not correct (using a browser). Check output below:

>> Issue: [B320:blacklist] Using lxml.etree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.fromstring with its defusedxml equivalent function.
   Severity: Medium   Confidence: High
   Location: <location of file>
   More Info: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b313-b320-xml-bad-etree

Expected behavior
Should generate links to https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b313-b320-xml instead of still linking to imports https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b313-b320-xml-bad-etree

Bandit version

bandit 1.6.2
  python version = 3.7.6 (default, Mar  3 2020, 09:46:53) [Clang 11.0.0 (clang-1100.0.33.17)]

[ericwb]

I'm unable to recreate this. In fact I don't see how this was ever possible, even on version 1.6.2.

As you can see here, kind is set to "calls" also with id of "b313-b320". How is it possible
to set "b313-b320" and go to the else statement where kind is "imports"

https://github.com/PyCQA/bandit/blob/1.6.2/bandit/core/docs_utils.py#L44

[ericwb]

If you have handy a complete example I can test with, that would be great. I used one of the existing samples and see no recreation of the bad link.

[ericwb]

Please try with the latest version, reopen if necessary. I suspect this might have been fixed with PR #507

[askb]

Can confirm regression with 1.7.4

Test results:

Issue: [B410:blacklist] Using etree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace etree with the equivalent defusedxml package.
Severity: Low Confidence: High
CWE: CWE-20 (https://cwe.mitre.org/data/definitions/20.html)
Location: scripts/bump_mri_versions/main.py:14:0
More Info: https://bandit.readthedocs.io/en/0.0.0/blacklists/blacklist_imports.html#b410-import-lxml