I've got a bunch of django_mark_safe
errors
>> Issue: [B703:django_mark_safe] Potential XSS on mark_safe function.
Severity: Medium Confidence: High
Location: ...
More Info: https://bandit.readthedocs.io/en/latest/plugins/b703_django_mark_safe.html
54 return mark_safe(f'<a href="{url}" target="_blank">{title}</a>')
>> Issue: [B308:blacklist] Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
Severity: Medium Confidence: High
Location: ...
More Info: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b308-mark-safe
54 return mark_safe(f'<a href="{url}" target="_blank">{title}</a>')
And I'm curious if there is a way to skip or ignore such lines? I understand that using mark_safe
could be dangerous, but what if I want to take the risk? For example this method is the only way to display custom link in Django admin, so I don't know any other option how to do it without mark_safe
I've got an answer here:
Two ways:
- You can skip the B703 and B308 using the --skip argument to the command line.
- Or you can affix a comment
# nosec
on the line to skip.https://bandit.readthedocs.io/en/latest/config.html#exclusions