pyscg-0034 is assumin implicit optional types against PEP484

未關閉
  • 哪裡不對？
#2 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

還沒有人認領這個 Issue。

評估

難度
3/5
預估耗時
1-2 天
新手友好度
52/100
Issue 類型
文件
描述清晰度
基本清楚
活躍度
活躍
技術堆疊
python
領域
documentation, security

研究方向

Read the pyscg-0034 guideline section linked in the issue, especially its compliant and non-compliant examples, and compare the stated rule with the Optional type annotations and behavior described in the report. Decide whether the recommendation should be corrected or removed, then update the guideline so its rule and examples agree; done means the guidance addresses the reported type-checking and input-validation concerns.

由索引模型根據 Issue 內容生成。

描述

bug

The python guideline psycg-0034 is incorrect, or at least outdated, you shouldn't check that a typed signature is not None if it's not typed as optional, and this is the behaviour of most type checkers, like mypy after 0.991 release.

The compliant case has the same explotation as the non compliant one, if you input another param.

is_valid_name(1) will raise an exception on both compliant and not compliant. There is no difference between None and 1, and there is no null pointer dereference in any case. If you try to pass an incorrect type to a function you will get a type error. You should check for None, if the function can receive None. And check for everything if the function can return anything. In any case, if you don't trust the param, you can get RCE with any param, even checking:

""" Compliant Code Example """
from typing import Optional


def is_valid_name(s: Optional[str]) -> bool:
    """ Check if the input is a name with 2 capitalised Strings """
    if s is None:
        return False
    if isinstance(s, str):
        names = s.split()
        if len(names) != 2:
            return False
        return s.istitle()


#####################
# Attempting to exploit above code example
#####################
class Exploit(str):
    def split(self):
        print("you are hacked")
name = is_valid_name(Exploit())

I suggest delete that recommendation

主要語言
Python
星號
2
分支
2
平均合併
11 分鐘
30 天內合併 PR
2

環境準備

  • 沒有 Dockerfile 或 Docker Compose 檔案
  • 沒有 Pull Request 範本
  • 閱讀貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

ossf/python-secure-coding-guide 的其他 Issue

查看 ossf/python-secure-coding-guide 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。