[flake8-bandit] Stabilize unsafe-markup-use (S704)
#16643
Conversation
Summary -- Stabilizes S704, which is also being recoded from RUF035 in 0.10. Test Plan -- Existing tests with `PreviewMode` removed from the settings. There was one issue closed on 2024-12-20 calling the rule noisy and asking for a config option, but the option was added and then there were no more issues or PRs.
CodSpeed Performance ReportMerging #16643 will degrade performances by 12.73%Comparing Summary
Benchmarks breakdown
|
|
| code | total | + violation | - violation | + fix | - fix |
|---|---|---|---|---|---|
| S704 | 30 | 30 | 0 | 0 | 0 |
Linter (preview)
✅ ecosystem check detected no linter changes.
|
There appear to be a few varieties of false positives here:
These seem pretty tricky to handle in general, so I don't necessarily think they should halt stabilization. The main case that would be nice to handle is probably checking if a variable passed to |
I agree; supporting this would be nice. I'm less concerned about keeping |
I would consider this a true positive, considering you can inject markup with your username there. They pass f-strings into that function. It might be possible for them to add
Indeed, people should be directed towards
Correct, the rule does not support indirect assignment yet, it's part of and documented in the test cases.
Yeah, I've seen those. Once again I think it's good to direct them towards Maybe we could add a strictness setting as a compromise, if there's sufficient demand for allowing f-strings and |
|
Alternatively we could consider adding an unsafe fix for converting simple interpolations inside |
|
Thanks again for the context, I think it does make sense to push people toward Let's go ahead and stabilize this, and I'll open an issue to track the |
Summary -- Stabilizes S704, which is also being recoded from RUF035 in 0.10. Test Plan -- Existing tests with `PreviewMode` removed from the settings. There was one issue closed on 2024-12-20 calling the rule noisy and asking for a config option, but the option was added and then there were no more issues or PRs.
Summary -- Stabilizes S704, which is also being recoded from RUF035 in 0.10. Test Plan -- Existing tests with `PreviewMode` removed from the settings. There was one issue closed on 2024-12-20 calling the rule noisy and asking for a config option, but the option was added and then there were no more issues or PRs.
Summary
Stabilizes S704, which is also being recoded from RUF035 in 0.10.
Test Plan
Existing tests with
PreviewModeremoved from the settings.There was one issue closed on 2024-12-20 calling the rule noisy and asking for a config option, but the option was added and then there were no more issues or PRs.