Skip to content

Blacklist call B309 not relevant any longer #857

@ericwb

Description

@ericwb

Describe the bug

B309 blacklist call checks for HTTPSConnection usage which was insecure in Python version prior to 2.7.9 and 3.4.3 because it didn't check certificate or hostnames. However, Bandit only supports a minimum of Python 3.7 now.

https://docs.python.org/3.5/library/http.client.html#http.client.HTTPSConnection

Reproduction steps

1. See https://docs.python.org/3.5/library/http.client.html#http.client.HTTPSConnection
2. Notice the comments in https://github.com/PyCQA/bandit/blob/main/bandit/blacklists/calls.py#L492 on versions affected.

Expected behavior

I expect there is no longer a need for this check.

Bandit version

1.7.4 (Default)

Python version

3.10 (Default)

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions