Skip to content

Commit

Permalink
Remove blacklist call to input() (PyCQA#662)
Browse files Browse the repository at this point in the history
Now that bandit 1.6.3 is Python 3.x only, there is no longer a
need to check for a Python 2.x security issue. Namely, input()
is considered safe in Python 3.x.

Fixes PyCQA#596

Signed-off-by: Eric Brown <browne@vmware.com>
  • Loading branch information
ericwb authored and mikespallino committed Aug 25, 2021
1 parent d62c918 commit a450e9e
Show file tree
Hide file tree
Showing 4 changed files with 4 additions and 18 deletions.
1 change: 0 additions & 1 deletion README.rst
Original file line number Diff line number Diff line change
Expand Up @@ -220,7 +220,6 @@ Usage::
B319 xml_bad_pulldom
B320 xml_bad_etree
B321 ftplib
B322 input
B323 unverified_context
B324 hashlib_new_insecure_functions
B325 tempnam
Expand Down
13 changes: 4 additions & 9 deletions bandit/blacklists/calls.py
Original file line number Diff line number Diff line change
Expand Up @@ -266,7 +266,9 @@
+------+---------------------+------------------------------------+-----------+
B322: input
------------
-----------
The check for this call has been removed.
The input method in Python 2 will read from standard input, evaluate and
run the resulting string as python source code. This is similar, though in
Expand Down Expand Up @@ -543,14 +545,7 @@ def gen_blacklist():
'HIGH'
))

sets.append(utils.build_conf_dict(
'input', 'B322', ['input'],
'The input method in Python 2 will read from standard input, '
'evaluate and run the resulting string as python source code. This '
'is similar, though in many ways worse, than using eval. On Python '
'2, use raw_input instead, input is safe in Python 3.',
'HIGH'
))
# skipped B322 as the check for a call to input() has been removed

sets.append(utils.build_conf_dict(
'unverified_context', 'B323', ['ssl._create_unverified_context'],
Expand Down
1 change: 0 additions & 1 deletion examples/input.py

This file was deleted.

7 changes: 0 additions & 7 deletions tests/functional/test_functional.py
Original file line number Diff line number Diff line change
Expand Up @@ -772,13 +772,6 @@ def test_baseline_filter(self):
self.assertEqual(1, len(self.b_mgr.baseline))
self.assertEqual({}, self.b_mgr.get_issue_list())

def test_blacklist_input(self):
expect = {
'SEVERITY': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 1},
'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 1}
}
self.check_example('input.py', expect)

def test_unverified_context(self):
'''Test for `ssl._create_unverified_context`.'''
expect = {
Expand Down

0 comments on commit a450e9e

Please sign in to comment.