You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/Secure-Coding-Guide-for-Python/CWE-703/CWE-252/README.md
+9-14Lines changed: 9 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,26 +16,24 @@ This non-compliant code example shows a common mistake when trying to update an
16
16
""" Non-compliant Code Example """
17
17
18
18
19
-
defsanitize_string(user_input):
20
-
"""Function that ensure a given string is safe"""
19
+
defsilly_string(user_input):
20
+
"""Function that changes the content of a string"""
21
21
user_input.replace("un", "very ")
22
+
return user_input
22
23
23
24
24
-
my_string ="unsafe string"
25
-
sanitize_string(my_string)
26
-
27
25
#####################
28
26
# exploiting above code example
29
27
#####################
30
-
print(my_string)
28
+
print(silly_string("unsafe string"))
31
29
32
30
```
33
31
34
-
Despite calling `sanitize_string()`, the value of my_string remains "unsafe string" instead of the expected "very safe string" as the return value of `str.replace()` has been ignored.
32
+
Despite calling `silly_string()`, "unsafe string" is printed instead of the expected "very safe string" as the return value of `str.replace()` has been ignored.
35
33
36
34
## Compliant Solution - Immutable objects
37
35
38
-
This compliant solution correctly returns the value from `str.replace()` and assigns it to `my_string`:
36
+
This compliant solution correctly returns the value from `str.replace()` and then prints it:
39
37
40
38
*[compliant01.py](compliant01.py):*
41
39
@@ -45,18 +43,15 @@ This compliant solution correctly returns the value from `str.replace()` and ass
45
43
""" Compliant Code Example """
46
44
47
45
48
-
defsanitize_string(user_input):
49
-
"""Function that ensure a given string is safe"""
46
+
defsilly_string(user_input):
47
+
"""Function that changes the content of a string"""
0 commit comments