Mark/easystitch
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[Security] MEDIUM: 17 Python security issue(s) #20

New issue
Closed
opened 2026-05-17 10:10:56 +00:00 by Mark · 1 comment
Mark commented 2026-05-17 10:10:56 +00:00
Owner
Copy link

Bandit Security Linter Findings

  • MEDIUM B314: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/dom_resolution/dom_resolution_engine.py (line 69)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/dom_resolver/dom_resolver.py (line 58)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/dom_resolver/dom_resolver.py (line 673)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/raster/raster_converter.py (line 468)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/svg_annotation/element_classifier.py (line 276)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/svg_annotation/element_classifier.py (line 378)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/svg_annotation/semantic_analyzer.py (line 31)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/svg_annotation/semantic_analyzer.py (line 88)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/svg_annotation/semantic_analyzer.py (line 133)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/svg_annotation/semantic_analyzer.py (line 185)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/svg_annotation/semantic_analyzer.py (line 262)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/svg_annotation/semantic_analyzer.py (line 318)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/svg_annotation/style_processor.py (line 50)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/svg_parser/parser.py (line 68)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/svg_parser/parser.py (line 71)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/svg_parser/parser.py (line 75)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/easystitch/src/utils/validation.py (line 34)

Auto-filed by security-sweep.py on 2026-05-17 03:10 UTC

## Bandit Security Linter Findings - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/dom_resolution/dom_resolution_engine.py` (line 69)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/dom_resolver/dom_resolver.py` (line 58)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/dom_resolver/dom_resolver.py` (line 673)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/raster/raster_converter.py` (line 468)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/svg_annotation/element_classifier.py` (line 276)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/svg_annotation/element_classifier.py` (line 378)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/svg_annotation/semantic_analyzer.py` (line 31)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/svg_annotation/semantic_analyzer.py` (line 88)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/svg_annotation/semantic_analyzer.py` (line 133)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/svg_annotation/semantic_analyzer.py` (line 185)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/svg_annotation/semantic_analyzer.py` (line 262)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/svg_annotation/semantic_analyzer.py` (line 318)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/svg_annotation/style_processor.py` (line 50)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/svg_parser/parser.py` (line 68)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/svg_parser/parser.py` (line 71)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/svg_parser/parser.py` (line 75)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/easystitch/src/utils/validation.py` (line 34)* --- *Auto-filed by security-sweep.py on 2026-05-17 03:10 UTC*
Mark commented 2026-05-19 00:31:42 +00:00
Author
Owner
Copy link

Quickfix applied via opencode.

Quickfix applied via opencode.
Mark 2026-05-19 00:31:42 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
blocked:children

   
blocked:depends-101

Depends on Mark/easystitch#101 landing first.

  
blocked:depends-103

Depends on corresponding issue landing first.

  
blocked:depends-104

Depends on corresponding issue landing first.

  
blocked:needs-attention

Session stuck or abandoned, needs human review

  
blocked:needs-decision

   
blocked:no-changes

   
blocked:preflight

Held by kilo-gsd preflight until lint-cleanup lands

  
bug

Something is not working correctly

  
chore

Config/cleanup items (reporter lane)

  
feature-request

   
in-progress

Claimed by kilo-gsd pipeline

  
lint-cleanup

Repo-wide lint cleanup ticket — kilo-gsd preflight hard-gate

  
needs-decompose

   
performance

   
quality

   
quickfix

   
security/medium

Medium severity security issue

  
triage-approved

Triage: approved for fixer pipeline

No labels
blocked:children
blocked:depends-101
blocked:depends-103
blocked:depends-104
blocked:needs-attention
blocked:needs-decision
blocked:no-changes
blocked:preflight
bug
chore
feature-request
in-progress
lint-cleanup
needs-decompose
performance
quality
quickfix
security/medium
triage-approved
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Mark/easystitch#20
No description provided.