Skip to content

Commit 458ff87

Browse files
authored
Update README.md
Updated the first set of code examples. Signed-off-by: Hubert Daniszewski <[email protected]>
1 parent ba5aef5 commit 458ff87

File tree

1 file changed

+9
-14
lines changed
  • docs/Secure-Coding-Guide-for-Python/CWE-703/CWE-252

1 file changed

+9
-14
lines changed

docs/Secure-Coding-Guide-for-Python/CWE-703/CWE-252/README.md

Lines changed: 9 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -16,26 +16,24 @@ This non-compliant code example shows a common mistake when trying to update an
1616
""" Non-compliant Code Example """
1717

1818

19-
def sanitize_string(user_input):
20-
"""Function that ensure a given string is safe"""
19+
def silly_string(user_input):
20+
"""Function that changes the content of a string"""
2121
user_input.replace("un", "very ")
22+
return user_input
2223

2324

24-
my_string = "unsafe string"
25-
sanitize_string(my_string)
26-
2725
#####################
2826
# exploiting above code example
2927
#####################
30-
print(my_string)
28+
print(silly_string("unsafe string"))
3129

3230
```
3331

34-
Despite calling `sanitize_string()`, the value of my_string remains "unsafe string" instead of the expected "very safe string" as the return value of `str.replace()` has been ignored.
32+
Despite calling `silly_string()`, "unsafe string" is printed instead of the expected "very safe string" as the return value of `str.replace()` has been ignored.
3533

3634
## Compliant Solution - Immutable objects
3735

38-
This compliant solution correctly returns the value from `str.replace()` and assigns it to `my_string`:
36+
This compliant solution correctly returns the value from `str.replace()` and then prints it:
3937

4038
*[compliant01.py](compliant01.py):*
4139

@@ -45,18 +43,15 @@ This compliant solution correctly returns the value from `str.replace()` and ass
4543
""" Compliant Code Example """
4644

4745

48-
def sanitize_string(user_input):
49-
"""Function that ensure a given string is safe"""
46+
def silly_string(user_input):
47+
"""Function that changes the content of a string"""
5048
return user_input.replace("un", "very ")
5149

5250

53-
my_string = "unsafe string"
54-
my_string = sanitize_string(my_string)
55-
5651
#####################
5752
# exploiting above code example
5853
#####################
59-
print(my_string)
54+
print(silly_string("unsafe string"))
6055

6156
```
6257

0 commit comments

Comments
 (0)