pyscg-0034 is assumin implicit optional types against PEP484

Abierto
  • ¿Algo no está bien?
#2 1 comentario 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
52/100
Tipo de issue
Documentación
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
python
Área
documentation, security

Línea de trabajo

Read the pyscg-0034 guideline section linked in the issue, especially its compliant and non-compliant examples, and compare the stated rule with the Optional type annotations and behavior described in the report. Decide whether the recommendation should be corrected or removed, then update the guideline so its rule and examples agree; done means the guidance addresses the reported type-checking and input-validation concerns.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug

The python guideline psycg-0034 is incorrect, or at least outdated, you shouldn't check that a typed signature is not None if it's not typed as optional, and this is the behaviour of most type checkers, like mypy after 0.991 release.

The compliant case has the same explotation as the non compliant one, if you input another param.

is_valid_name(1) will raise an exception on both compliant and not compliant. There is no difference between None and 1, and there is no null pointer dereference in any case. If you try to pass an incorrect type to a function you will get a type error. You should check for None, if the function can receive None. And check for everything if the function can return anything. In any case, if you don't trust the param, you can get RCE with any param, even checking:

""" Compliant Code Example """
from typing import Optional


def is_valid_name(s: Optional[str]) -> bool:
    """ Check if the input is a name with 2 capitalised Strings """
    if s is None:
        return False
    if isinstance(s, str):
        names = s.split()
        if len(names) != 2:
            return False
        return s.istitle()


#####################
# Attempting to exploit above code example
#####################
class Exploit(str):
    def split(self):
        print("you are hacked")
name = is_valid_name(Exploit())

I suggest delete that recommendation

Lenguaje dominante
Python
Estrellas
2
Forks
2
Merge medio
11 min
PR fusionados (30 d)
2

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de ossf/python-secure-coding-guide

Todos los issues de ossf/python-secure-coding-guide

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.