-
-
Notifications
You must be signed in to change notification settings - Fork 683
Closed
Labels
bugSomething isn't workingSomething isn't working
Description
Describe the bug
B309 blacklist call checks for HTTPSConnection usage which was insecure in Python version prior to 2.7.9 and 3.4.3 because it didn't check certificate or hostnames. However, Bandit only supports a minimum of Python 3.7 now.
https://docs.python.org/3.5/library/http.client.html#http.client.HTTPSConnection
Reproduction steps
1. See https://docs.python.org/3.5/library/http.client.html#http.client.HTTPSConnection
2. Notice the comments in https://github.com/PyCQA/bandit/blob/main/bandit/blacklists/calls.py#L492 on versions affected.
Expected behavior
I expect there is no longer a need for this check.
Bandit version
1.7.4 (Default)
Python version
3.10 (Default)
Additional context
No response
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working