ContextQMD
Back to Ruff

`unsafe-markup-use` (`S704`)

crates/ruff_linter/resources/mdtest/flake8-bandit/unsafe-markup-use.md

0.15.142.2 KB
Original Source

unsafe-markup-use (S704)

toml
lint.select = ["S704"]

Basic tests

One example diagnostic:

py
import flask
from markupsafe import Markup, escape

content = "<script>alert('Hello, world!')</script>"
Markup(f"unsafe {content}")  # snapshot: unsafe-markup-use
snapshot
error[S704]: Unsafe use of `markupsafe.Markup` detected
 --> src/mdtest_snippet.py:5:1
  |
5 | Markup(f"unsafe {content}")  # snapshot: unsafe-markup-use
  | ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  |
py
flask.Markup("unsafe {}".format(content))  # error: [unsafe-markup-use]
Markup("safe {}").format(content)
flask.Markup(b"safe {}", encoding='utf-8').format(content)
escape(content)
Markup(content)  # error: [unsafe-markup-use]
flask.Markup("unsafe %s" % content)  # error: [unsafe-markup-use]
Markup(object="safe")

This case is not currently detected, despite also being unsafe:

py
Markup(object="unsafe {}".format(content))

These cases are false positives that we may be able to eliminate with ty if it includes comprehensive constant expression detection/evaluation.

py
Markup("*" * 8)  # error: [unsafe-markup-use]
flask.Markup("hello {}".format("world"))  # error: [unsafe-markup-use]

extend-markup-names

toml
lint.select = ["S704"]
lint.flake8-bandit.extend-markup-names = ["webhelpers.html.literal"]
py
from markupsafe import Markup
from webhelpers.html import literal

content = "<script>alert('Hello, world!')</script>"
Markup(f"unsafe {content}")  # error: [unsafe-markup-use]
literal(f"unsafe {content}")  # error: [unsafe-markup-use]

This test case exists to make sure our optimization doesn't cause additional markup names to be skipped if we don't import either markupsafe or flask first.

py
from webhelpers.html import literal

content = "<script>alert('Hello, world!')</script>"
literal(f"unsafe {content}")  # error: [unsafe-markup-use]

allowed-markup-calls

toml
lint.select = ["S704"]
lint.flake8-bandit.allowed-markup-calls = ["bleach.clean"]
py
from bleach import clean
from markupsafe import Markup

content = "<script>alert('Hello, world!')</script>"
Markup(clean(content))

# indirect assignments are currently not supported
cleaned = clean(content)
Markup(cleaned)  # error: [unsafe-markup-use]