# `unsafe-markup-use` (`S704`)

```toml
lint.select = ["S704"]
```

## Basic tests

One example diagnostic:

```py
import flask
from markupsafe import Markup, escape

content = "<script>alert('Hello, world!')</script>"
Markup(f"unsafe {content}")  # snapshot: unsafe-markup-use
```

```snapshot
error[S704]: Unsafe use of `markupsafe.Markup` detected
 --> src/mdtest_snippet.py:5:1
  |
5 | Markup(f"unsafe {content}")  # snapshot: unsafe-markup-use
  | ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  |
```

```py
flask.Markup("unsafe {}".format(content))  # error: [unsafe-markup-use]
Markup("safe {}").format(content)
flask.Markup(b"safe {}", encoding='utf-8').format(content)
escape(content)
Markup(content)  # error: [unsafe-markup-use]
flask.Markup("unsafe %s" % content)  # error: [unsafe-markup-use]
Markup(object="safe")
```

This case is not currently detected, despite also being unsafe:

```py
Markup(object="unsafe {}".format(content))
```

These cases are false positives that we may be able to eliminate with
ty if it includes comprehensive constant expression
detection/evaluation.

```py
Markup("*" * 8)  # error: [unsafe-markup-use]
flask.Markup("hello {}".format("world"))  # error: [unsafe-markup-use]
```

## `extend-markup-names`

```toml
lint.select = ["S704"]
lint.flake8-bandit.extend-markup-names = ["webhelpers.html.literal"]
```

```py
from markupsafe import Markup
from webhelpers.html import literal

content = "<script>alert('Hello, world!')</script>"
Markup(f"unsafe {content}")  # error: [unsafe-markup-use]
literal(f"unsafe {content}")  # error: [unsafe-markup-use]
```

This test case exists to make sure our optimization doesn't cause
additional markup names to be skipped if we don't import either
`markupsafe` or `flask` first.

```py
from webhelpers.html import literal

content = "<script>alert('Hello, world!')</script>"
literal(f"unsafe {content}")  # error: [unsafe-markup-use]
```

## `allowed-markup-calls`

```toml
lint.select = ["S704"]
lint.flake8-bandit.allowed-markup-calls = ["bleach.clean"]
```

```py
from bleach import clean
from markupsafe import Markup

content = "<script>alert('Hello, world!')</script>"
Markup(clean(content))

# indirect assignments are currently not supported
cleaned = clean(content)
Markup(cleaned)  # error: [unsafe-markup-use]
```
