astral-sh/ruff

Avoid raising S310 if user explicitly checks for URL scheme

Open

#7,918 opened on Oct 11, 2023

View on GitHub
 (13 comments) (11 reactions) (0 assignees)Rust (2,088 forks)batch import
help wantedrule

Repository metrics

Stars
 (47,527 stars)
PR merge metrics
 (Avg merge 3d 8h) (573 merged PRs in 30d)

Description

  • A minimal code snippet that reproduces the bug.
import urllib.request


def foo(url: str) -> None:
    if not url.startswith(("https://", "http://")):
        raise ValueError
    req = urllib.request.Request(
        url,
        headers=headers,
        data=data,
        method=method,
    )
    resp = urllib.request.urlopen(req)

Also it would be great if ruff could recognize asserts (like assert url.startswith(("https://", "http://")))

  • The command you invoked (e.g., ruff /path/to/file.py --fix), ideally including the --isolated flag.

ruff --isolated --select S t.py

  • The current Ruff settings (any relevant sections from your pyproject.toml).

No pyproject.toml

  • The current Ruff version (ruff --version).

ruff 0.0.292

Contributor guide

Research direction
Inspect the S310 rule implementation in Ruff's source code (likely in crates/ruff linter/src/rules/flake8 bandit.rs or similar). Identify the logic that detects URL usage and add a check to see if there is a preceding explicit URL scheme check (like `url.startswith` with https/http) or an assertion. Modify the rule to skip raising S310 when such a check is present.
Tech stack
pythonrust
Domain
backend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
Pythonbasic Rust
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60