B704 false negative for local Markup subclasses (CVE-2025-54384)

[invoke1442]

Describe the bug

B704 catches direct use of markupsafe.Markup / flask.Markup, but it misses the same pattern when a project wraps Markup in a local subclass.

That causes false negatives on real CVE code. One example is CVE-2025-54384 in CKAN and CVE-2025-64187 in OctoPrint: user-controlled HTML is processed, insufficiently sanitized, and then wrapped in a local literal(Markup) class. Stock Bandit does not report these.

Reproduction steps

import re
from markdown import markdown
from markupsafe import Markup

RE_MD_HTML_TAGS = re.compile(r"<[^><]*>")

class literal(Markup):
    pass

def markdown_extract(text):
    plain = RE_MD_HTML_TAGS.sub("", markdown(text))
    return literal(plain)


Run Bandit on this file with the stock ruleset.

Expected behavior

I would expect a B704-style finding here.

This is the same unsafe sink as Markup(...), just behind a local subclass. It seems reasonable for B704 to handle simple subclasses / wrappers of markupsafe.Markup, not only exact qualified names.

Bandit version

1.9.1 (Default)

Python version

3.10

Additional context

No response

[ARUNMANIKANDAN-C]

Hi! I see this issue is currently unassigned. I would love to take a look at this and work on a fix for my first contribution to the project. Are there any specific files in the AST directory you recommend I start looking at?

[invoke1442]

@ARUNMANIKANDAN-C Thanks for taking a look : )

The most relevant starting point is bandit/plugins/markupsafe_markup_xss.py

If you end up needing to trace how Bandit resolves call targets / names in AST context, bandit/core/context.py is probably the next place.