blacklist_imports — Bandit documentation (2024)

B401: import_telnetlib¶

A telnet-related module is being imported. Telnet is considered insecure. UseSSH or some other encrypted protocol.

B402: import_ftplib¶

A FTP-related module is being imported. FTP is considered insecure. UseSSH/SFTP/SCP or some other encrypted protocol.

B403: import_pickle¶

Consider possible security implications associated with these modules.

B404: import_subprocess¶

Consider possible security implications associated with these modules.

B405: import_xml_etree¶

Using various methods to parse untrusted XML data is known to be vulnerable toXML attacks. Replace vulnerable imports with the equivalent defusedxml package,or make sure defusedxml.defuse_stdlib() is called.

B406: import_xml_sax¶

Using various methods to parse untrusted XML data is known to be vulnerable toXML attacks. Replace vulnerable imports with the equivalent defusedxml package,or make sure defusedxml.defuse_stdlib() is called.

B407: import_xml_expat¶

Using various methods to parse untrusted XML data is known to be vulnerable toXML attacks. Replace vulnerable imports with the equivalent defusedxml package,or make sure defusedxml.defuse_stdlib() is called.

B408: import_xml_minidom¶

Using various methods to parse untrusted XML data is known to be vulnerable toXML attacks. Replace vulnerable imports with the equivalent defusedxml package,or make sure defusedxml.defuse_stdlib() is called.

B409: import_xml_pulldom¶

Using various methods to parse untrusted XML data is known to be vulnerable toXML attacks. Replace vulnerable imports with the equivalent defusedxml package,or make sure defusedxml.defuse_stdlib() is called.

B410: import_lxml¶

Using various methods to parse untrusted XML data is known to be vulnerable toXML attacks. Replace vulnerable imports with the equivalent defusedxml package.

B411: import_xmlrpclib¶

XMLRPC is particularly dangerous as it is also concerned with communicatingdata over a network. Use defused.xmlrpc.monkey_patch() function to monkey-patchxmlrpclib and mitigate remote XML attacks.

B412: import_httpoxy¶

httpoxy is a set of vulnerabilities that affect application code running inCGI, or CGI-like environments. The use of CGI for web applications should beavoided to prevent this class of attack. More details are availableat https://httpoxy.org/.

B413: import_pycrypto¶

pycrypto library is known to have publicly disclosed buffer overflowvulnerability https://github.com/dlitz/pycrypto/issues/176. It is no longeractively maintained and has been deprecated in favor of pyca/cryptographylibrary.

B414: import_pycryptodome¶

This import blacklist has been removed. The information here has beenleft for historical purposes.

pycryptodome is a direct fork of pycrypto that has not fully addressedthe issues inherent in PyCrypto. It seems to exist, mainly, as an APIcompatible continuation of pycrypto and should be deprecated in favorof pyca/cryptography which has more support among the Python community.