B405.md

Pattern: Import of xml.etree.ElementTree module

Issue: -

Description

Using various methods to parse untrusted XML data is known to be vulnerable to XML attacks. Replace vulnerable imports with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

This rule checks for the following imports:

• xml.etree.cElementTree
• xml.etree.ElementTree

Further Reading

• The Python Standard Library - xml.etree.ElementTree
• GitHub - defusedxml
• Bandit - B405: import_xml_etree