pyscg-0034 is assumin implicit optional types against PEP484

Aberta
  • Algo errado?
#2 1 comentário 0 reações 0 responsáveis Ver no GitHub

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
3/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
52/100
Tipo de issue
Documentação
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
python
Domínio
documentation, security

Direção de pesquisa

Read the pyscg-0034 guideline section linked in the issue, especially its compliant and non-compliant examples, and compare the stated rule with the Optional type annotations and behavior described in the report. Decide whether the recommendation should be corrected or removed, then update the guideline so its rule and examples agree; done means the guidance addresses the reported type-checking and input-validation concerns.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

bug

The python guideline psycg-0034 is incorrect, or at least outdated, you shouldn't check that a typed signature is not None if it's not typed as optional, and this is the behaviour of most type checkers, like mypy after 0.991 release.

The compliant case has the same explotation as the non compliant one, if you input another param.

is_valid_name(1) will raise an exception on both compliant and not compliant. There is no difference between None and 1, and there is no null pointer dereference in any case. If you try to pass an incorrect type to a function you will get a type error. You should check for None, if the function can receive None. And check for everything if the function can return anything. In any case, if you don't trust the param, you can get RCE with any param, even checking:

""" Compliant Code Example """
from typing import Optional


def is_valid_name(s: Optional[str]) -> bool:
    """ Check if the input is a name with 2 capitalised Strings """
    if s is None:
        return False
    if isinstance(s, str):
        names = s.split()
        if len(names) != 2:
            return False
        return s.istitle()


#####################
# Attempting to exploit above code example
#####################
class Exploit(str):
    def split(self):
        print("you are hacked")
name = is_valid_name(Exploit())

I suggest delete that recommendation

Linguagem predominante
Python
Estrelas
2
Forks
2
Merge médio
11min
PRs com merge (30d)
2

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de ossf/python-secure-coding-guide

Todas as issues de ossf/python-secure-coding-guide

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.