Skip to content

contributing: Use SPDX copyright tags in file headers - #7743

Open
wenzeslaus wants to merge 1 commit into
OSGeo:mainfrom
wenzeslaus:spdx-headers
Open

contributing: Use SPDX copyright tags in file headers#7743
wenzeslaus wants to merge 1 commit into
OSGeo:mainfrom
wenzeslaus:spdx-headers

contributing: Use SPDX copyright tags in file headers

50e2ee8
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / Bandit succeeded Jul 17, 2026 in 5s

25 new alerts

New alerts in code changed by this pull request

  • 18 warnings
  • 7 notes

Alerts not introduced by this pull request might have been detected because the code changes were too large.

See annotations below for details.

View all branch alerts.

Annotations

Check warning on line 234 in scripts/v.in.wfs/v.in.wfs.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

Check warning on line 189 in scripts/v.in.wfs/v.in.wfs.py

See this annotation in the file changed.

Code scanning / Bandit

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. Warning

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.

Check warning on line 164 in scripts/v.import/v.import.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

Check warning on line 155 in scripts/v.import/v.import.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

Check warning on line 329 in scripts/i.tasscap/i.tasscap.py

See this annotation in the file changed.

Code scanning / Bandit

Use of possibly insecure function - consider using safer ast.literal_eval. Warning

Use of possibly insecure function - consider using safer ast.literal_eval.

Check warning on line 220 in scripts/g.search.modules/g.search.modules.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

Check warning on line 212 in scripts/g.search.modules/g.search.modules.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

Check warning on line 203 in scripts/g.search.modules/g.search.modules.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

Check warning on line 75 in scripts/g.manual/g.manual.py

See this annotation in the file changed.

Code scanning / Bandit

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. Warning

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.

Check warning on line 1290 in scripts/g.extension/g.extension.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

Check warning on line 582 in scripts/g.extension/g.extension.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

Check warning on line 567 in scripts/g.extension/g.extension.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

Check warning on line 553 in scripts/g.extension/g.extension.py

See this annotation in the file changed.

Code scanning / Bandit

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. Warning

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.

Check warning on line 497 in scripts/g.extension/g.extension.py

See this annotation in the file changed.

Code scanning / Bandit

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. Warning

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.

Check warning on line 488 in scripts/g.extension/g.extension.py

See this annotation in the file changed.

Code scanning / Bandit

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. Warning

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.

Check warning on line 182 in scripts/g.extension.all/g.extension.all.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

Check warning on line 92 in scripts/g.extension.all/g.extension.all.py

See this annotation in the file changed.

Code scanning / Bandit

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. Warning

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.

Check warning on line 69 in scripts/g.extension.all/g.extension.all.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

Check notice on line 127 in scripts/g.manual/g.manual.py

See this annotation in the file changed.

Code scanning / Bandit

Starting a process with a partial executable path Note

Starting a process with a partial executable path

Check notice on line 68 in scripts/g.search.modules/g.search.modules.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. Note

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

Check notice on line 156 in scripts/g.extension/g.extension.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. Note

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

Check notice on line 103 in scripts/v.import/v.import.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. Note

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

Check notice on line 44 in scripts/g.extension.all/g.extension.all.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. Note

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

Check notice on line 230 in scripts/v.in.wfs/v.in.wfs.py

See this annotation in the file changed.

Code scanning / Bandit

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. Note

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

Check notice on line 116 in locale/grass_po_stats.py

See this annotation in the file changed.

Code scanning / Bandit

Starting a process with a partial executable path Note

Starting a process with a partial executable path