Skip to content

Commit c7c85f2

Browse files
myteronmyteron
committed
pySCG: adding docs for CWE-1109 as part of #531
Signed-off-by: Helge Wehder <[email protected]>
1 parent 60a786a commit c7c85f2

File tree

6 files changed

+232
-27
lines changed

6 files changed

+232
-27
lines changed

‎docs/Secure-Coding-Guide-for-Python/CWE-710/CWE-1109/README.md‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
# CWE-1109: Use of Same Variable for Multiple Purposes
2+
3+
Avoid reusing names of variables, functions, classes, built-in functions, packages, or standard Python modules
4+
5+
Redefining identifiers from *The Python Standard Library* \[[Python 2025](https://docs.python.org/3/library/index.html)\], any internals `str` and `os` or other parts of the project can result in unexpected behavior and errors. Issues can multiply when identifiers are made global in a project.
6+
7+
## Non-Compliant Code Example (Built-in Function)
8+
9+
The redefined built-in function `len()` in `noncompliant01.py` in incorrectly adding each element to a "sum" instead of calculating the length of an object.
10+
11+
*[noncompliant01.py](noncompliant01.py):*
12+
13+
```python
14+
# SPDX-FileCopyrightText: OpenSSF project contributors
15+
# SPDX-License-Identifier: MIT
16+
"""Non-compliant Code Example"""
17+
18+
number_list = [1, 2, 3, 4, 5, 6, 7, 8, 9]
19+
print(f"len({number_list}) == {len(number_list)}")
20+
21+
22+
def len(numbers: list[int]) -> int:
23+
"""implementing a dodgy version of a build in method"""
24+
result = 0
25+
for number in numbers:
26+
result += number
27+
return result
28+
29+
30+
#####################
31+
# Trying to exploit above code example
32+
#####################
33+
34+
print(f"len({number_list}) == {len(number_list)}")
35+
36+
```
37+
38+
The first `print(f"len({number_list}) == {len(number_list)}")` using the original `len()` is listing the correct number of `9` entries.
39+
The second print statement using the redefined `len()` is listing `45`.
40+
41+
**Example output:**
42+
43+
```bash
44+
len([1, 2, 3, 4, 5, 6, 7, 8, 9]) == 9
45+
len([1, 2, 3, 4, 5, 6, 7, 8, 9]) == 45
46+
```
47+
48+
Redefining `len()` can break its usage for other data types such as strings causing crashes. The redefined `len()` will cause a `print(len("Hello World!"))` to throw a `TypeError` as we combine `int` with `char`.
49+
50+
## Compliant Solution (Built-in Function)
51+
52+
Ensure that all functions do not reuse the names as defined in Built-in Functions \[[Python built-in 2025](https://docs.python.org/3.9/library/functions.html)\] and do not reuse the identifiers as defined in The *The Python Standard Library* \[[Python 2025](https://docs.python.org/3/library/index.html)\].
53+
54+
*[compliant01.py](compliant01.py):*
55+
56+
```python
57+
# SPDX-FileCopyrightText: OpenSSF project contributors
58+
# SPDX-License-Identifier: MIT
59+
"""Compliant Code Example"""
60+
61+
number_list = [1, 2, 3, 4, 5, 6, 7, 8, 9]
62+
print(f"len({number_list}) == {len(number_list)}")
63+
64+
65+
def custom_len(numbers: list[int]) -> int:
66+
"""implementing a dodgy version of a build in method"""
67+
result = 0
68+
for number in numbers:
69+
result += number
70+
return result
71+
72+
73+
#####################
74+
# Trying to exploit above code example
75+
#####################
76+
77+
print(f"len({number_list}) == {len(number_list)}")
78+
79+
```
80+
81+
## Non-Compliant Code Example (Class)
82+
83+
The standard module `os` and function `getpid()` are being redefined in `noncompliant02.py`.
84+
85+
*[noncompliant02.py](noncompliant02.py):*
86+
87+
```python
88+
# SPDX-FileCopyrightText: OpenSSF project contributors
89+
# SPDX-License-Identifier: MIT
90+
"""Non-compliant Code Example"""
91+
92+
import os
93+
94+
print(f"Process id='{os.getpid()}'")
95+
96+
97+
class os:
98+
"""redefining standard class"""
99+
100+
@staticmethod
101+
def getpid():
102+
"""redefining standard class method"""
103+
return "Not implemented"
104+
105+
106+
#####################
107+
# Trying to exploit above code example
108+
#####################
109+
110+
print(f"Process id='{os.getpid()}'")
111+
112+
```
113+
114+
The `os.getpid()` method from the standard module is no longer called after redefining it and prints "Not implemented" instead of the process ID.
115+
116+
**Example output:**
117+
118+
```bash
119+
Process id='19354'
120+
Process id='Not implemented'
121+
```
122+
123+
## Compliant Solution (Class)
124+
125+
Ensure that all packages, classes and functions do not reuse the identifiers as defined in *The Python Standard Library* \[[Python 2025](https://docs.python.org/3/library/index.html)\].
126+
127+
*[compliant02.py](compliant02.py):*
128+
129+
```python
130+
# SPDX-FileCopyrightText: OpenSSF project contributors
131+
# SPDX-License-Identifier: MIT
132+
"""Compliant Code Example"""
133+
134+
import os
135+
136+
print(f"Process id='{os.getpid()}'")
137+
138+
139+
class custom_os:
140+
"""redefining standard class"""
141+
142+
@staticmethod
143+
def getpid():
144+
"""redefining standard class method"""
145+
return "Not implemented"
146+
147+
148+
#####################
149+
# Trying to exploit above code example
150+
#####################
151+
152+
print(f"Process id='{os.getpid()}'")
153+
154+
```
155+
156+
## Automated Detection
157+
158+
On the 'class' example we have `C0103` complains about missing PascalCase naming style, `R0801`: Similar lines in `2` files, and `R0903` we do not list as their detection is not in relation to the actual issue.
159+
160+
|Tool|Version|Checker|Description|
161+
|:---|:---|:---|:---|
162+
|pylint|2.9.6|[W0622](https://pylint.pycqa.org/en/latest/user_guide/messages/warning/redefined-builtin.html?highlight=W0622)|Redefining built-in 'len' (redefined-builtin)|
163+
|pylint|2.9.6|[E0102](https://pylint.pycqa.org/en/latest/user_guide/messages/error/function-redefined.html)|class already defined line 5 (function-redefined), detecting `class os`:|
164+
165+
## Related Guidelines
166+
167+
|||
168+
|:---|:---|
169+
|[MITRE CWE](http://cwe.mitre.org/)|Pillar: [CWE-710: Improper Adherence to Coding Standards)](https://cwe.mitre.org/data/definitions/710.html)|
170+
|[MITRE CWE](http://cwe.mitre.org/)|Base: [CWE - CWE-1109: Use of Same Variable for Multiple Purposes](https://cwe.mitre.org/data/definitions/1109.html)|
171+
|[SEI CERT Coding Standard for Java](https://wiki.sei.cmu.edu/confluence/display/java/SEI+CERT+Oracle+Coding+Standard+for+Java)|[DCL01-J. Do not reuse public identifiers from the Java Standard Library](https://wiki.sei.cmu.edu/confluence/display/java/DCL01-J.+Do+not+reuse+public+identifiers+from+the+Java+Standard+Library)|
172+
|[SEI CERT C Coding Standard](https://web.archive.org/web/20220511061752/https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Coding+Standard)|[PRE04-C. Do not reuse a standard header file name](https://wiki.sei.cmu.edu/confluence/display/c/PRE04-C.+Do+not+reuse+a+standard+header+file+name)|
173+
|[SEI CERT C++ Coding Standard](https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=88046682)|[VOID PRE04-CPP. Do not reuse a standard header file name](https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=88046904)|
174+
175+
## Bibliography
176+
177+
|||
178+
|:---|:---|
179+
|\[Python 2025\].|*The Python Standard Library* \[online\]. Available from: <https://docs.python.org/3/library/index.html> \[accessed 24 June 2025\]|
180+
|\[Python built-in 2025\].|*Built-in Functions* \[online\]. Available from: <https://docs.python.org/3.9/library/functions.html> \[accessed 24 June 2025\]|

‎docs/Secure-Coding-Guide-for-Python/CWE-710/CWE-1109/compliant01.py‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,21 @@
11
# SPDX-FileCopyrightText: OpenSSF project contributors
22
# SPDX-License-Identifier: MIT
3-
""" Compliant Code Example """
4-
numbers = ["one", "two", "three"]
3+
"""Compliant Code Example"""
54

6-
print(f"len({numbers}) == {len(numbers)}")
5+
number_list = [1, 2, 3, 4, 5, 6, 7, 8, 9]
6+
print(f"len({number_list}) == {len(number_list)}")
77

88

9-
def custom_len(x):
10-
""" implementing a dodgy version of a build in method """
11-
return sum(1 for _ in x) + 1
9+
def custom_len(numbers: list[int]) -> int:
10+
"""implementing a dodgy version of a build in method"""
11+
result = 0
12+
for number in numbers:
13+
result += number
14+
return result
1215

1316

14-
print(f"len({numbers}) == {len(numbers)}")
17+
#####################
18+
# Trying to exploit above code example
19+
#####################
20+
21+
print(f"len({number_list}) == {len(number_list)}")

‎docs/Secure-Coding-Guide-for-Python/CWE-710/CWE-1109/compliant02.py‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,23 @@
11
# SPDX-FileCopyrightText: OpenSSF project contributors
22
# SPDX-License-Identifier: MIT
3-
""" Compliant Code Example """
3+
"""Compliant Code Example"""
4+
45
import os
56

6-
print(f"Logged in user is {os.getlogin()}")
7+
print(f"Process id='{os.getpid()}'")
78

89

910
class custom_os:
10-
""" redefining standard class """
11+
"""redefining standard class"""
1112

1213
@staticmethod
13-
def getlogin():
14-
""" redefining standard class method """
14+
def getpid():
15+
"""redefining standard class method"""
1516
return "Not implemented"
1617

1718

18-
print(f"Logged in user is {os.getlogin()}")
19+
#####################
20+
# Trying to exploit above code example
21+
#####################
22+
23+
print(f"Process id='{os.getpid()}'")

‎docs/Secure-Coding-Guide-for-Python/CWE-710/CWE-1109/noncompliant01.py‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,21 @@
11
# SPDX-FileCopyrightText: OpenSSF project contributors
22
# SPDX-License-Identifier: MIT
3-
""" Non-compliant Code Example """
4-
numbers = ["one", "two", "three"]
3+
"""Non-compliant Code Example"""
54

6-
print(f"len({numbers}) == {len(numbers)}")
5+
number_list = [1, 2, 3, 4, 5, 6, 7, 8, 9]
6+
print(f"len({number_list}) == {len(number_list)}")
77

88

9-
def len(x):
10-
""" implementing a dodgy version of a build in method """
11-
return sum(1 for _ in x) + 1
9+
def len(numbers: list[int]) -> int:
10+
"""implementing a dodgy version of a build in method"""
11+
result = 0
12+
for number in numbers:
13+
result += number
14+
return result
1215

1316

14-
print(f"len({numbers}) == {len(numbers)}")
17+
#####################
18+
# Trying to exploit above code example
19+
#####################
20+
21+
print(f"len({number_list}) == {len(number_list)}")

‎docs/Secure-Coding-Guide-for-Python/CWE-710/CWE-1109/noncompliant02.py‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,23 @@
11
# SPDX-FileCopyrightText: OpenSSF project contributors
22
# SPDX-License-Identifier: MIT
3-
""" Non-compliant Code Example """
3+
"""Non-compliant Code Example"""
4+
45
import os
5-
print(f"Logged in user is {os.getlogin()}")
6+
7+
print(f"Process id='{os.getpid()}'")
68

79

810
class os:
9-
""" redefining standard class """
11+
"""redefining standard class"""
1012

1113
@staticmethod
12-
def getlogin():
13-
""" redefining standard class method """
14+
def getpid():
15+
"""redefining standard class method"""
1416
return "Not implemented"
1517

1618

17-
print(f"Logged in user is {os.getlogin()}")
19+
#####################
20+
# Trying to exploit above code example
21+
#####################
22+
23+
print(f"Process id='{os.getpid()}'")

‎docs/Secure-Coding-Guide-for-Python/readme.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ It is __not production code__ and requires code-style or python best practices t
109109
|[CWE-710: Improper Adherence to Coding Standards](https://cwe.mitre.org/data/definitions/710.html)|Prominent CVE|
110110
|:----------------------------------------------------------------|:----|
111111
|[CWE-1095: Loop Condition Value Update within the Loop](CWE-710/CWE-1095/README.md)||
112-
|[CWE-1109: Use of Same Variable for Multiple Purposes](CWE-710/CWE-1109/.)||
112+
|[CWE-1109: Use of Same Variable for Multiple Purposes](CWE-710/CWE-1109/README.md)||
113113
|[CWE-489: Active Debug Code](CWE-710/CWE-489/README.md)|[CVE-2018-14649](https://www.cvedetails.com/cve/CVE-2018-14649),<br/>CVSSv3.1: __9.8__,<br/>EPSS: __69.64__ (12.12.2023)|
114114

115115
## Biblography

0 commit comments

Comments
 (0)