Skip to content

Commit 8b675cc

Browse files
s19110s19110
authored
Adding documentation to CWE-617 as part of #531 (#651)
* Adding documentation to CWE-617 as part of #531 Signed-off-by: edanhub <[email protected]> * Added cosmetic fixes for CWE-617 Signed-off-by: edanhub <[email protected]> --------- Signed-off-by: edanhub <[email protected]>
1 parent 956b581 commit 8b675cc

File tree

5 files changed

+268
-1
lines changed

5 files changed

+268
-1
lines changed

‎docs/Secure-Coding-Guide-for-Python/CWE-664/CWE-681/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ if Decimal("2").compare(t) == 0:
5454
|[MITRE CWE](http://cwe.mitre.org/)|Base:<br>[CWE-681, Incorrect Conversion between Numeric Types](https://cwe.mitre.org/data/definitions/681.html)|
5555
|[SEI CERT Oracle Coding Standard for Java](https://wiki.sei.cmu.edu/confluence/display/java/SEI+CERT+Oracle+Coding+Standard+for+Java)|[NUM11-J. Do not compare or inspect the string representation of floating-point values](https://wiki.sei.cmu.edu/confluence/display/java/NUM11-J.+Do+not+compare+or+inspect+the+string+representation+of+floating-point+values)|
5656

57-
## Related Guidelines
57+
## Bibliography
5858

5959
|||
6060
|:---|:---|

‎docs/Secure-Coding-Guide-for-Python/CWE-691/CWE-617/README.md‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
# CWE-617: Reachable Assertion
2+
3+
Assertions are a useful developer tool, but they cannot be relied upon to be present in a production environment. Incorrect function arguments should be handled by an appropriate exception.
4+
5+
Python removes assertions when a script is run with the `-O` and `-OO` options [[Python 3.9 Documentation](https://docs.python.org/3.9/using/cmdline.html?highlight=pythonoptimize#cmdoption-o)].
6+
7+
## Non-Compliant Code Example
8+
9+
The code is checking for invalid arguments by using assertions. In this example, any positive integer between `1-709` inclusive is valid, and any other argument is invalid.
10+
11+
If the script is run normally, the assertions will catch the invalid arguments. If the script is run in optimized mode, assertions are removed from the bytecode and the function will not work as intended. To simplify the exploit code, the specific exception raised by the argument is caught.
12+
13+
[*noncompliant01.py:*](noncompliant01.py)
14+
15+
```py
16+
""" Non-compliant Code Example """
17+
import math
18+
19+
20+
def my_exp(x):
21+
assert x in range(
22+
1, 710
23+
), f"Argument {x} is not valid" # range(1, 709) produces 1-708
24+
return math.exp(x)
25+
26+
27+
#####################
28+
# exploiting above code example
29+
#####################
30+
31+
try:
32+
print(my_exp(1))
33+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
34+
print(e)
35+
36+
try:
37+
print(my_exp(709))
38+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
39+
print(e)
40+
41+
try:
42+
print(my_exp(710))
43+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
44+
print(e)
45+
46+
try:
47+
print(my_exp(0))
48+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
49+
print(e)
50+
51+
try:
52+
print(my_exp("b"))
53+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
54+
print(e)
55+
56+
# output
57+
58+
# $ python3.9 noncompliant01.py
59+
# 2.718281828459045
60+
# 8.218407461554972e+307
61+
# Argument 710 is not valid
62+
# Argument 0 is not valid
63+
# Argument b is not valid
64+
# $ python3.9 -O noncompliant01.py
65+
# 2.718281828459045
66+
# 8.218407461554972e+307
67+
# math range error
68+
# 1.0
69+
# must be real number, not str
70+
71+
```
72+
73+
## Compliant Solution
74+
75+
The `my_exp()` function raises a `ValueError` exception if an invalid argument is supplied. This works if the script is run in an optimized mode or not.
76+
77+
[*compliant01.py:*](compliant01.py)
78+
79+
```py
80+
""" Compliant Code Example """
81+
import math
82+
83+
84+
def my_exp(x):
85+
if x not in range(1, 710): # range(1, 709) produces 1-708
86+
raise ValueError(f"Argument {x} is not valid")
87+
return math.exp(x)
88+
89+
90+
#####################
91+
# exploiting above code example
92+
#####################
93+
94+
try:
95+
print(my_exp(1))
96+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
97+
print(e)
98+
99+
try:
100+
print(my_exp(709))
101+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
102+
print(e)
103+
104+
try:
105+
print(my_exp(710))
106+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
107+
print(e)
108+
109+
try:
110+
print(my_exp(0))
111+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
112+
print(e)
113+
114+
try:
115+
print(my_exp("b"))
116+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
117+
print(e)
118+
119+
# output
120+
121+
# $ python3.9 compliant01.py
122+
# 2.718281828459045
123+
# 8.218407461554972e+307
124+
# Argument 710 is not valid
125+
# Argument 0 is not valid
126+
# Argument b is not valid
127+
# $ python3.9 -O compliant01.py
128+
# 2.718281828459045
129+
# 8.218407461554972e+307
130+
# Argument 710 is not valid
131+
# Argument 0 is not valid
132+
# Argument b is not valid
133+
134+
```
135+
136+
## Automated Detection
137+
138+
|Tool|Version|Checker|Description|
139+
|:---|:---|:---|:---|
140+
|Bandit|1.6.2|B101:assert_used|Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.|
141+
142+
## Related Guidelines
143+
144+
|||
145+
|:---|:---|
146+
|[MITRE CWE](http://cwe.mitre.org/)|Pillar<br>[CWE-691: Insufficient Control Flow Management (4.13) (mitre.org)](https://cwe.mitre.org/data/definitions/691.html)|
147+
|[MITRE CWE](http://cwe.mitre.org/)|Base:<br>[CWE-617, Reachable Assertion](https://cwe.mitre.org/data/definitions/617.html)|
148+
149+
## Bibliography
150+
151+
|||
152+
|:---|:---|
153+
|[[Python 3.9 Documentation](https://docs.python.org/3.9/)]|Python Software Foundation. (2024). Command line and environment - cmdoption -o [online].<br>Available from: [https://docs.python.org/3.9/using/cmdline.html?highlight=pythonoptimize#cmdoption-o](https://docs.python.org/3.9/using/cmdline.html?highlight=pythonoptimize#cmdoption-o)<br>[accessed 10 October 2024].|

‎docs/Secure-Coding-Guide-for-Python/CWE-691/CWE-617/compliant01.py‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# SPDX-FileCopyrightText: OpenSSF project contributors
2+
# SPDX-License-Identifier: MIT
3+
import math
4+
5+
6+
def my_exp(x):
7+
if x not in range(1, 710): # range(1, 709) produces 1-708
8+
raise ValueError(f"Argument {x} is not valid")
9+
return math.exp(x)
10+
11+
12+
#####################
13+
# exploiting above code example
14+
#####################
15+
16+
try:
17+
print(my_exp(1))
18+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
19+
print(e)
20+
21+
try:
22+
print(my_exp(709))
23+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
24+
print(e)
25+
26+
try:
27+
print(my_exp(710))
28+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
29+
print(e)
30+
31+
try:
32+
print(my_exp(0))
33+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
34+
print(e)
35+
36+
try:
37+
print(my_exp("b"))
38+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
39+
print(e)
40+
41+
# output
42+
43+
# $ python3.9 compliant01.py
44+
# 2.718281828459045
45+
# 8.218407461554972e+307
46+
# Argument 710 is not valid
47+
# Argument 0 is not valid
48+
# Argument b is not valid
49+
# $ python3.9 -O compliant01.py
50+
# 2.718281828459045
51+
# 8.218407461554972e+307
52+
# Argument 710 is not valid
53+
# Argument 0 is not valid
54+
# Argument b is not valid
55+

‎docs/Secure-Coding-Guide-for-Python/CWE-691/CWE-617/noncompliant01.py‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# SPDX-FileCopyrightText: OpenSSF project contributors
2+
# SPDX-License-Identifier: MIT
3+
import math
4+
5+
6+
def my_exp(x):
7+
assert x in range(
8+
1, 710
9+
), f"Argument {x} is not valid" # range(1, 709) produces 1-708
10+
return math.exp(x)
11+
12+
13+
#####################
14+
# exploiting above code example
15+
#####################
16+
17+
try:
18+
print(my_exp(1))
19+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
20+
print(e)
21+
22+
try:
23+
print(my_exp(709))
24+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
25+
print(e)
26+
27+
try:
28+
print(my_exp(710))
29+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
30+
print(e)
31+
32+
try:
33+
print(my_exp(0))
34+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
35+
print(e)
36+
37+
try:
38+
print(my_exp("b"))
39+
except (AssertionError, OverflowError, TypeError, ValueError) as e:
40+
print(e)
41+
42+
# output
43+
44+
# $ python3.9 noncompliant01.py
45+
# 2.718281828459045
46+
# 8.218407461554972e+307
47+
# Argument 710 is not valid
48+
# Argument 0 is not valid
49+
# Argument b is not valid
50+
# $ python3.9 -O noncompliant01.py
51+
# 2.718281828459045
52+
# 8.218407461554972e+307
53+
# math range error
54+
# 1.0
55+
# must be real number, not str

‎docs/Secure-Coding-Guide-for-Python/readme.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,10 @@ It is **not production code** and requires code-style or python best practices t
6161
|[CWE-1335: Promote readability and compatibility by using mathematical written code with arithmetic operations instead of bit-wise operations](CWE-682/CWE-1335/01/README.md)||
6262
|[CWE-1339: Insufficient Precision or Accuracy of a Real Number](CWE-682/CWE-1339/.) ||
6363

64+
|[CWE-691: Insufficient Control Flow Management](https://cwe.mitre.org/data/definitions/691.html)|Prominent CVE|
65+
|:---------------------------------------------------------------------------------------------------------------|:----|
66+
|[CWE-617: Reachable Assertion](CWE-691/CWE-617/README.md)||
67+
6468
|[CWE-693: Protection Mechanism Failure](https://cwe.mitre.org/data/definitions/693.html)|Prominent CVE|
6569
|:----------------------------------------------------------------|:----|
6670
|[CWE-184: Incomplete List of Disallowed Input](CWE-693/CWE-184/.)||

0 commit comments

Comments
 (0)