Deprecated Module Import

ID

python.deprecated_module

Severity

info

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Python

Tags

deprecated, reliability

Description

Reports import statements for modules that have been removed or deprecated in modern Python. The default deny-list catches:

  • removed in Python 3 (md5, sha, commands, popen2, mimetools, MimeWriter),

  • removed in Python 3.12 (distutils, imp, asynchat, asyncore, binhex, smtpd),

  • deprecated and slated for removal (optparse, telnetlib, nntplib, uu, xdrlib, aifc, sunau, chunk, pipes, cgi, cgitb, crypt, fileinput, ossaudiodev, audioop, imageop).

import distutils                     # FLAW
import imp                           # FLAW
from md5 import new                  # FLAW

from hashlib import md5              # OK
import setuptools                    # OK

Rationale

Removed modules raise ImportError outright. Deprecated modules emit a DeprecationWarning today and will become removed in a future release; catching them at code-review time avoids the eventual emergency upgrade.

Configuration

The list is configurable via the rule’s modules property in the scan profile. Projects targeting an older Python (e.g. 3.8) can drop entries that are still available in that release.

Remediation

Each deprecated module has a documented modern replacement:

Deprecated Replacement

md5 / sha

hashlib

commands

subprocess

popen2

subprocess

distutils

setuptools / pyproject.toml / packaging

imp

importlib

optparse

argparse

asynchat / asyncore

asyncio

cgi

a real web framework (flask, django, …​)

References