@@ -5,15 +5,16 @@ In python, some datasets use `NaN` (not-a-number) to represent the missing data.
5
5
6
6
This behavior is compliant with IEEE 754[[ 2024 Wikipedia]] ( https://en.wikipedia.org/wiki/IEEE_754 ) a hardware induced compromise.
7
7
The [ example01.py] ( example01.py ) code demonstrates various comparisons of float('NaN') all resulting in False
8
+
8
9
``` python
9
10
# SPDX-FileCopyrightText: OpenSSF project contributors
10
11
# SPDX-License-Identifier: MIT
11
12
""" Code Example """
12
-
13
+
13
14
foo = float (' NaN' )
14
15
print (f " foo= { foo} type = { type (foo)} " )
15
-
16
-
16
+
17
+
17
18
print (foo == float (" NaN" ) or
18
19
foo is float (" NaN" ) or
19
20
foo < 3 or
@@ -22,6 +23,7 @@ print(foo == float("NaN") or
22
23
)
23
24
24
25
```
26
+
25
27
## Non-Compliant Code Example
26
28
27
29
This noncompliant code example [[ 2024 docs.python.org]] ( https://docs.python.org/3/reference/expressions.html#value-comparisons ) attempts a direct comparison with NaN in
@@ -34,8 +36,8 @@ _value == float("NaN").
34
36
# SPDX-FileCopyrightText: OpenSSF project contributors
35
37
# SPDX-License-Identifier: MIT
36
38
""" Non-compliant Code Example """
37
-
38
-
39
+
40
+
39
41
def balance_is_positive (value : str ) -> bool :
40
42
""" Returns True if there is still enough value for a transaction"""
41
43
_value = float (value)
@@ -45,8 +47,8 @@ def balance_is_positive(value: str) -> bool:
45
47
return False
46
48
else :
47
49
return True
48
-
49
-
50
+
51
+
50
52
# ####################
51
53
# attempting to exploit above code example
52
54
# ####################
@@ -70,17 +72,18 @@ The decision by the `balance_is_positive` method is to `ROUND_DOWN` instead of t
70
72
# SPDX-FileCopyrightText: OpenSSF project contributors
71
73
# SPDX-License-Identifier: MIT
72
74
""" Compliant Code Example """
75
+
73
76
from decimal import ROUND_DOWN , Decimal
74
-
75
-
77
+
78
+
76
79
def balance_is_positive (value : str ) -> bool :
77
80
""" Returns True if there is still enough value for a transaction"""
78
81
# TODO : additional input sanitation for expected type
79
82
_value = Decimal(value)
80
83
# TODO : exception handling
81
84
return _value.quantize(Decimal(" .01" ), rounding = ROUND_DOWN ) > Decimal(" 0.00" )
82
-
83
-
85
+
86
+
84
87
# ####################
85
88
# attempting to exploit above code example
86
89
# ####################
@@ -100,9 +103,10 @@ In `compliant02.py` we use the `math.isnan` to verify if the value passed is a v
100
103
# SPDX-FileCopyrightText: OpenSSF project contributors
101
104
# SPDX-License-Identifier: MIT
102
105
""" Compliant Code Example """
106
+
103
107
import math
104
-
105
-
108
+
109
+
106
110
def balance_is_positive (value : str ) -> bool :
107
111
""" Returns True if there is still enough value for a transaction"""
108
112
_value = float (value)
@@ -112,8 +116,8 @@ def balance_is_positive(value: str) -> bool:
112
116
return False
113
117
else :
114
118
return True
115
-
116
-
119
+
120
+
117
121
# ####################
118
122
# attempting to exploit above code example
119
123
# ####################
0 commit comments