pylint 1.4 reports E1101(no-member) on all C extensions

Shortly after posting my question, I found the answer. The change was in fact done on purpose as a security measure. Pylint imports modules to effectively identify valid methods and attributes. It was decided that importing c extensions that are not part of the python stdlib is a security risk and could introduce malicious code.

This was done in the release of Astroid 1.3.1 https://mail.python.org/pipermail/code-quality/2014-November/000394.html

Only C extensions from trusted sources (the standard library) are
loaded into the examining Python process to build an AST from the live
module.

There are four solutions if you want to use pylint on projects that import non-stdlib c extensions.

1) Disable safety using the --unsafe-load-any-extension=y command line option. This feature is undocumented and classified as a hidden option (https://mail.python.org/pipermail/code-quality/2014-November/000439.html).

2) Disable safety using the pylint.rc setting unsafe-load-any-extensions=yes. This is recommended over option 1 and includes full documentation in the default pylint.rc file (created with --generate-rcfile).

3) Specifically list packages or modules names that you trust to be loaded by pylint in the pylint.rc file using the extension-pkg-whitelist= option.

4) Create a plugin to manipulate the AST (I have no idea how to effect this — but it’s regularly discussed on on the pylint mailing list).

We opted for Option 3. We added the following line to our project pylint.rc file:

extension-pkg-whitelist=lxml

Leave a Comment