PyCQA / bandit

Bandit is a tool designed to find common security issues in Python code.
https://bandit.readthedocs.io
Apache License 2.0
6.51k stars 612 forks source link

Improper detection of non-requests module #1011

Closed ericwb closed 1 year ago

ericwb commented 1 year ago

Fixes false postive detecting the usage of the requests module without a timeout. This resolves cases of modules with the word "requests" in the name, but does not match the actual popular third-party module "requests".

The fix checks the fully qualified name and ensures index 0 is "requests". Previously, the code was match any module name with "requests" in it.

Fixes #1010