B314 since Python 3.6 is not valid about bandit

[ericwb]

So after some digging on this topic. Seems Python has a vendored version of expat embedded. This is the default version (at least for macOS and Windows). However, it does seem permitted
to use an external system level version. So maybe there is still a window of vulnerability there? In any case, the latest minor versions of Python 3.8 to 3.12 all vendor expat 2.5.0 now.
So it might make sense to deprecate or remove this check.

[ericwb]

To see the vendored version of expat embedded in Python you can browse to:
https://github.com/python/cpython/blob/3.8/Modules/expat/expat.h#L1056C20-L1056C20

At the bottom of this header file you'll find the expat major, minor, and micro version.

[ericwb]

However, I also found that the oldest version of Python 3.8, 3.8.0, which Bandit officially still supports does include an older, vulnerable version of expat 2.2.8:
https://github.com/python/cpython/blob/v3.8.0/Modules/expat/expat.h#L1016

The same can be found for Python 3.9.0:
https://github.com/python/cpython/blob/v3.9.0/Modules/expat/expat.h#L1016

Python 3.10.0 is the first minor version to have the fixed expat 2.4.1:
https://github.com/python/cpython/blob/v3.10.0/Modules/expat/expat.h#L1042

As such, we should leave this plugin check for xml.etree.ElementTree at least until 3.9.0
is end-of-life.

[ericwb]

Expat 2.4.1 wasn't added to Python 3.8 till 3.8.12. Similar for 3.9, not until 3.9.7.

[CyberKatze]

I also checked the latest patch for python 3.6 (3.6.15) and 3.7 (3.7.17), both are safe. only from (3.5 <=) latest patch didn't include the fix. I couldn't find their repo branches that I can refer to, but I just tested by running all possible 5 possible xml vulns.
might be useful to know.