Skip to content

Commit c0b1413

Browse files
DaverballMichaReiser
Daverball
and
MichaReiser
committed
[flake8-bandit] Move unsafe-markup-use from RUF035 to S704 (#15957)
## Summary `RUF035` has been backported into bandit as `S704` in this [PR](PyCQA/bandit#1225) This moves the rule and its corresponding setting to the `flake8-bandit` category ## Test Plan `cargo nextest run` --------- Co-authored-by: Micha Reiser <micha@reiser.io>
1 parent 798fa47 commit c0b1413

26 files changed

Lines changed: 436 additions & 261 deletions

‎crates/ruff/tests/snapshots/show_settings__display_default_settings.snap‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -226,6 +226,8 @@ linter.flake8_bandit.hardcoded_tmp_directory = [
226226
/dev/shm,
227227
]
228228
linter.flake8_bandit.check_typed_exception = false
229+
linter.flake8_bandit.extend_markup_names = []
230+
linter.flake8_bandit.allowed_markup_calls = []
229231
linter.flake8_bugbear.extend_immutable_calls = []
230232
linter.flake8_builtins.builtins_allowed_modules = []
231233
linter.flake8_builtins.builtins_ignorelist = []
@@ -369,8 +371,6 @@ linter.pylint.max_public_methods = 20
369371
linter.pylint.max_locals = 15
370372
linter.pyupgrade.keep_runtime_typing = false
371373
linter.ruff.parenthesize_tuple_in_subscript = false
372-
linter.ruff.extend_markup_names = []
373-
linter.ruff.allowed_markup_calls = []
374374

375375
# Formatter Settings
376376
formatter.exclude = []

crates/ruff_linter/resources/test/fixtures/ruff/RUF035.py renamed to crates/ruff_linter/resources/test/fixtures/flake8_bandit/S704.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,17 @@
22
from markupsafe import Markup, escape
33

44
content = "<script>alert('Hello, world!')</script>"
5-
Markup(f"unsafe {content}") # RUF035
6-
flask.Markup("unsafe {}".format(content)) # RUF035
5+
Markup(f"unsafe {content}") # S704
6+
flask.Markup("unsafe {}".format(content)) # S704
77
Markup("safe {}").format(content)
88
flask.Markup(b"safe {}", encoding='utf-8').format(content)
99
escape(content)
10-
Markup(content) # RUF035
11-
flask.Markup("unsafe %s" % content) # RUF035
10+
Markup(content) # S704
11+
flask.Markup("unsafe %s" % content) # S704
1212
Markup(object="safe")
1313
Markup(object="unsafe {}".format(content)) # Not currently detected
1414

1515
# NOTE: We may be able to get rid of these false positives with red-knot
1616
# if it includes comprehensive constant expression detection/evaluation.
17-
Markup("*" * 8) # RUF035 (false positive)
18-
flask.Markup("hello {}".format("world")) # RUF035 (false positive)
17+
Markup("*" * 8) # S704 (false positive)
18+
flask.Markup("hello {}".format("world")) # S704 (false positive)

crates/ruff_linter/resources/test/fixtures/ruff/RUF035_extend_markup_names.py renamed to crates/ruff_linter/resources/test/fixtures/flake8_bandit/S704_extend_markup_names.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,5 @@
22
from webhelpers.html import literal
33

44
content = "<script>alert('Hello, world!')</script>"
5-
Markup(f"unsafe {content}") # RUF035
6-
literal(f"unsafe {content}") # RUF035
5+
Markup(f"unsafe {content}") # S704
6+
literal(f"unsafe {content}") # S704

crates/ruff_linter/resources/test/fixtures/ruff/RUF035_skip_early_out.py renamed to crates/ruff_linter/resources/test/fixtures/flake8_bandit/S704_skip_early_out.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@
44
# additional markup names to be skipped if we don't import either
55
# markupsafe or flask first.
66
content = "<script>alert('Hello, world!')</script>"
7-
literal(f"unsafe {content}") # RUF035
7+
literal(f"unsafe {content}") # S704

crates/ruff_linter/resources/test/fixtures/ruff/RUF035_whitelisted_markup_calls.py renamed to crates/ruff_linter/resources/test/fixtures/flake8_bandit/S704_whitelisted_markup_calls.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@
66

77
# indirect assignments are currently not supported
88
cleaned = clean(content)
9-
Markup(cleaned) # RUF035
9+
Markup(cleaned) # S704

‎crates/ruff_linter/src/checkers/ast/analyze/expression.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1129,7 +1129,7 @@ pub(crate) fn expression(expr: &Expr, checker: &Checker) {
11291129
refurb::rules::int_on_sliced_str(checker, call);
11301130
}
11311131
if checker.enabled(Rule::UnsafeMarkupUse) {
1132-
ruff::rules::unsafe_markup_call(checker, call);
1132+
flake8_bandit::rules::unsafe_markup_call(checker, call);
11331133
}
11341134
if checker.enabled(Rule::MapIntVersionParsing) {
11351135
ruff::rules::map_int_version_parsing(checker, call);

‎crates/ruff_linter/src/codes.rs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -690,6 +690,7 @@ pub fn code_to_rule(linter: Linter, code: &str) -> Option<(RuleGroup, Rule)> {
690690
(Flake8Bandit, "612") => (RuleGroup::Stable, rules::flake8_bandit::rules::LoggingConfigInsecureListen),
691691
(Flake8Bandit, "701") => (RuleGroup::Stable, rules::flake8_bandit::rules::Jinja2AutoescapeFalse),
692692
(Flake8Bandit, "702") => (RuleGroup::Stable, rules::flake8_bandit::rules::MakoTemplates),
693+
(Flake8Bandit, "704") => (RuleGroup::Preview, rules::flake8_bandit::rules::UnsafeMarkupUse),
693694

694695
// flake8-boolean-trap
695696
(Flake8BooleanTrap, "001") => (RuleGroup::Stable, rules::flake8_boolean_trap::rules::BooleanTypeHintPositionalArgument),
@@ -991,7 +992,7 @@ pub fn code_to_rule(linter: Linter, code: &str) -> Option<(RuleGroup, Rule)> {
991992
(Ruff, "032") => (RuleGroup::Stable, rules::ruff::rules::DecimalFromFloatLiteral),
992993
(Ruff, "033") => (RuleGroup::Stable, rules::ruff::rules::PostInitDefault),
993994
(Ruff, "034") => (RuleGroup::Stable, rules::ruff::rules::UselessIfElse),
994-
(Ruff, "035") => (RuleGroup::Preview, rules::ruff::rules::UnsafeMarkupUse),
995+
(Ruff, "035") => (RuleGroup::Removed, rules::ruff::rules::RuffUnsafeMarkupUse),
995996
(Ruff, "036") => (RuleGroup::Preview, rules::ruff::rules::NoneNotAtEndOfUnion),
996997
(Ruff, "037") => (RuleGroup::Preview, rules::ruff::rules::UnnecessaryEmptyIterableWithinDequeCall),
997998
(Ruff, "038") => (RuleGroup::Preview, rules::ruff::rules::RedundantBoolLiteral),

‎crates/ruff_linter/src/rule_redirects.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ static REDIRECTS: LazyLock<HashMap<&'static str, &'static str>> = LazyLock::new(
134134
("TCH005", "TC005"),
135135
("TCH006", "TC010"),
136136
("TCH010", "TC010"),
137+
("RUF035", "S704"),
137138
])
138139
});
139140

‎crates/ruff_linter/src/rules/flake8_bandit/mod.rs‎

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ mod tests {
103103
#[test_case(Rule::SuspiciousURLOpenUsage, Path::new("S310.py"))]
104104
#[test_case(Rule::SuspiciousNonCryptographicRandomUsage, Path::new("S311.py"))]
105105
#[test_case(Rule::SuspiciousTelnetUsage, Path::new("S312.py"))]
106+
#[test_case(Rule::UnsafeMarkupUse, Path::new("S704.py"))]
106107
fn preview_rules(rule_code: Rule, path: &Path) -> Result<()> {
107108
let snapshot = format!(
108109
"preview__{}_{}",
@@ -120,6 +121,51 @@ mod tests {
120121
Ok(())
121122
}
122123

124+
#[test_case(Rule::UnsafeMarkupUse, Path::new("S704_extend_markup_names.py"))]
125+
#[test_case(Rule::UnsafeMarkupUse, Path::new("S704_skip_early_out.py"))]
126+
fn extend_allowed_callable(rule_code: Rule, path: &Path) -> Result<()> {
127+
let snapshot = format!(
128+
"extend_allow_callables__{}_{}",
129+
rule_code.noqa_code(),
130+
path.to_string_lossy()
131+
);
132+
let diagnostics = test_path(
133+
Path::new("flake8_bandit").join(path).as_path(),
134+
&LinterSettings {
135+
flake8_bandit: super::settings::Settings {
136+
extend_markup_names: vec!["webhelpers.html.literal".to_string()],
137+
..Default::default()
138+
},
139+
preview: PreviewMode::Enabled,
140+
..LinterSettings::for_rule(rule_code)
141+
},
142+
)?;
143+
assert_messages!(snapshot, diagnostics);
144+
Ok(())
145+
}
146+
147+
#[test_case(Rule::UnsafeMarkupUse, Path::new("S704_whitelisted_markup_calls.py"))]
148+
fn whitelisted_markup_calls(rule_code: Rule, path: &Path) -> Result<()> {
149+
let snapshot = format!(
150+
"whitelisted_markup_calls__{}_{}",
151+
rule_code.noqa_code(),
152+
path.to_string_lossy()
153+
);
154+
let diagnostics = test_path(
155+
Path::new("flake8_bandit").join(path).as_path(),
156+
&LinterSettings {
157+
flake8_bandit: super::settings::Settings {
158+
allowed_markup_calls: vec!["bleach.clean".to_string()],
159+
..Default::default()
160+
},
161+
preview: PreviewMode::Enabled,
162+
..LinterSettings::for_rule(rule_code)
163+
},
164+
)?;
165+
assert_messages!(snapshot, diagnostics);
166+
Ok(())
167+
}
168+
123169
#[test]
124170
fn check_hardcoded_tmp_additional_dirs() -> Result<()> {
125171
let diagnostics = test_path(
@@ -132,7 +178,7 @@ mod tests {
132178
"/dev/shm".to_string(),
133179
"/foo".to_string(),
134180
],
135-
check_typed_exception: false,
181+
..Default::default()
136182
},
137183
..LinterSettings::for_rule(Rule::HardcodedTempFile)
138184
},

‎crates/ruff_linter/src/rules/flake8_bandit/rules/mod.rs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ pub(crate) use suspicious_imports::*;
2929
pub(crate) use tarfile_unsafe_members::*;
3030
pub(crate) use try_except_continue::*;
3131
pub(crate) use try_except_pass::*;
32+
pub(crate) use unsafe_markup_use::*;
3233
pub(crate) use unsafe_yaml_load::*;
3334
pub(crate) use weak_cryptographic_key::*;
3435

@@ -63,5 +64,6 @@ mod suspicious_imports;
6364
mod tarfile_unsafe_members;
6465
mod try_except_continue;
6566
mod try_except_pass;
67+
mod unsafe_markup_use;
6668
mod unsafe_yaml_load;
6769
mod weak_cryptographic_key;

0 commit comments

Comments
 (0)
⚡