Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove blacklist call to input() #662

Merged
merged 1 commit into from
Dec 9, 2020
Merged

Remove blacklist call to input() #662

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 0 additions & 1 deletion README.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,7 +220,6 @@ Usage::
B319 xml_bad_pulldom
B320 xml_bad_etree
B321 ftplib
B322 input
B323 unverified_context
B324 hashlib_new_insecure_functions
B325 tempnam
Expand Down
13 changes: 4 additions & 9 deletions bandit/blacklists/calls.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,7 +266,9 @@
+------+---------------------+------------------------------------+-----------+

B322: input
------------
-----------

The check for this call has been removed.

The input method in Python 2 will read from standard input, evaluate and
run the resulting string as python source code. This is similar, though in
Expand Down Expand Up @@ -543,14 +545,7 @@ def gen_blacklist():
'HIGH'
))

sets.append(utils.build_conf_dict(
'input', 'B322', ['input'],
'The input method in Python 2 will read from standard input, '
'evaluate and run the resulting string as python source code. This '
'is similar, though in many ways worse, than using eval. On Python '
'2, use raw_input instead, input is safe in Python 3.',
'HIGH'
))
# skipped B322 as the check for a call to input() has been removed

sets.append(utils.build_conf_dict(
'unverified_context', 'B323', ['ssl._create_unverified_context'],
Expand Down
1 change: 0 additions & 1 deletion examples/input.py
View file
Open in desktop

This file was deleted.

7 changes: 0 additions & 7 deletions tests/functional/test_functional.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -772,13 +772,6 @@ def test_baseline_filter(self):
self.assertEqual(1, len(self.b_mgr.baseline))
self.assertEqual({}, self.b_mgr.get_issue_list())

def test_blacklist_input(self):
expect = {
'SEVERITY': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 1},
'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 1}
}
self.check_example('input.py', expect)

def test_unverified_context(self):
'''Test for `ssl._create_unverified_context`.'''
expect = {
Expand Down