Skip to content
This repository has been archived by the owner on Oct 11, 2024. It is now read-only.

Ericsson/secure_coding_one_stop_shop_for_python

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

58 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

PAGE MOVED!



Note

This repository was permanently moved under OpenSSF wg-best-practices-os-developers/docs /Secure-Coding-Guide-for-Python/**







Secure Coding One Stop Shop for Python

Promote secure products by knowing the difference between secure compliant and non-compliant code with CPython >= 3.9 using modules listed on

Python Module Index [Python 2023].

This page is in initiative by Ericsson to improve secure coding in Python by providing a location for study. Its structure is based on Common Weakness Enamurator (CWE) Pillar Weakness [mitre.org 2023]. It currently contains only the code examples, documentation will follow.

Disclaimer

Content comes WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, as stated in the license text CC-BY-4.0 for documentation and MIT. Following or using the documentation and or code is at your own risk. Code examples are intended purely for educational use and not for products in parts or in full. Code examples are NOT to be used to cause harm of any kind to anyone or anything.

Introduction

Every person writing code shall study the following:

Secure Coding Standard for Python

Code examples are written to explain security design with as little code as possible demonstrating the issue in the noncompliantXX.py titled Python file. The compliantXX.py file demonstrates only the mitigation or removal of the described risk. None of the code examples are intendet to be used 'as is' for production. Using the code is at your own risk.

It is not production code and requires code-style or python best practices to be added such as:

  • Inline documentation
  • Custom exceptions
  • Full descriptive variable names
  • Line length limit
  • Proper logging instead of printing to stdout
  • Secure coding compliance outside of described issue
CWE-664: Improper Control of a Resource Through its Lifetime Prominent CVE
CWE-134: Use of Externally-Controlled Format String CVE-2022-27177,
CVSSv3.1: 9.8,
EPSS:00.37(01.12.2023)
CWE-197: Numeric Truncation Error
CWE-400: Uncontrolled Resource Consumption
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
CWE-410: Insufficient Resource Pool
CWE-501: Trust Boundary Violation)
CWE-502: Deserialization of Untrusted Data)
CWE-665: Improper Initialization
CWE-681: Improper Control of a Resource Through its Lifetime
CWE-833: Deadlock
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
XXX-005: Consider hash-based integrity verification of byte code files against their source code files
CWE-682: Incorrect Calculation Prominent CVE
CWE-1335: Promote readability and compatibility by using mathematical written code with arithmetic operations instead of bit-wise operations
CWE-1339: Insufficient Precision or Accuracy of a Real Number
CWE-693: Protection Mechanism Failure Prominent CVE
CWE-184: Incomplete List of Disallowed Input
CWE-330: Use of Insufficiently Random Values
CWE-798: Use of hardcoded credentials
CWE-703: Improper Check or Handling of Exceptional Conditions Prominent CVE
CWE-230: Improper Handling of Missing Values
CWE-392: Missing Report of Error Condition
CWE-754: Improper Check for Unusual or Exceptional Conditions
CWE-707: Improper Neutralization Prominent CVE
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2019-8600,
CVSSv3.1: 9.8,
EPSS:01.43(18.02.2024)
CWE-117: Improper Output Neutralization for Logs
CWE-180: Incorrect behavior order: Validate before Canonicalize
CWE-710: Improper Adherence to Coding Standards Prominent CVE
CWE-1095: Loop Condition Value Update within the Loop
CWE-1109: Use of Same Variable for Multiple Purposes

Biblography

Ref Detail
[Python 2023] 3.9 Module Index
[mitre.org 2023] CWE - CWE-1000: Research Concepts
[OWASP 2022] Secure Coding Practices-Quick Reference Guide
[OWASP 2022] OWASP Top 10 Report 2022
[MITRE 2023] CWE Top 25 2022

License