Module injection
Untrusted user imports in Python allow an attacker to load arbitrary code. To prevent malicious code from running, only allow imports from trusted libraries or from libraries on allow lists.
def module_injection_noncompliant():
    import importlib
    module_name = input('module name')
    # Noncompliant: Untrusted user input is being passed to `import_module`.
    importlib.import_module(module_name)
def module_injection_compliant():
    import importlib
    allowed_module_names_list = ['example_module1', 'example_module2']
    module_name = input('module name')
    if module_name in allowed_module_names_list:
        # Compliant: User input is validated before using in `import_module()`.
        importlib.import_module(module_name)