astral-sh/ruff
flake8-bandit import check should not trigger on TYPE_CHECKING imports or classes not in defusedxml
Offen
#14.901 geöffnet am 10.12.2024
help wanted
Repository-Metriken
- Stars
- (47.527 Sterne)
- PR-Merge-Metriken
- (Durchschn. Merge 3T 8h) (573 gemergte PRs in 30 T)
Beschreibung
The following code triggers S408 ("xml.dom.minidom is vulnerable to XML attacks"):
from typing import TYPE_CHECKING
if TYPE_CHECKING:
from xml.dom.minidom import Element
As far as I know, defusedxml, which this rule suggests as an alternative, does not supply alternative implementations for most of the types, only of some functions. In other words, I have to import types like these for the standard library; there is no defusedxml alternative.
So in order to signal to Ruff that "this is fine"™, I've tried moving the import to TYPE_CHECKING, but still received the same error.
This probably applies to other rules in the S4xx range, too.