ⓘ NOTE: This is a draft. Contributions welcome!
An initiative by the OpenSSF to provide new Python programmers a resource to study secure coding in CPython >= 3.9 with working code examples.
Documentation is written in academic style to support security researchers while using plain English to cater for an international audience.
Python modules outside of the Python Module Index [Python 2023] are specifically not covered by this document. The structure is based on Common Weakness Enumeration (CWE) Pillar Weakness [MITRE Pillar 2024].
Please join us, see contributing
Content comes WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, as stated in the license text CC-BY-4.0 for documentation and MIT. Following or using the documentation and or code is at your own risk. Code examples are intended purely for educational use and not for products in parts or in full. Code examples are NOT to be used to cause harm of any kind to anyone or anything.
Every person writing code shall study the following:
Code examples are written to explain security design with as little code as possible. None of the code examples are intended to be used ‘as is’ for production. Using the code is at your own risk!
Code file naming conventions:
noncompliantXX.py anti-pattern, bad programming practice.compliantXX.py mitigation or removal of ONLY the described risk.exampleXX.py to allow understanding the documented behaviour.It is not production code and requires code-style or python best practices to be added such as:
stdout| CWE-691: Insufficient Control Flow Management | Prominent CVE |
|---|---|
| CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization (“Race Condition”) | |
| CWE-617: Reachable Assertion |
| CWE-693: Protection Mechanism Failure | Prominent CVE |
|---|---|
| CWE-184: Incomplete List of Disallowed Input | |
| CWE-330: Use of Insufficiently Random Values | CVE-2020-7548, CVSSv3.1: 9.8, EPSS: 0.22 (12.12.2024) |
| CWE-798: Use of hardcoded credentials |
| CWE-697: Incorrect Comparison | Prominent CVE |
|---|---|
| CWE-595: Comparison of Object References Instead of Object Contents |
| CWE-710: Improper Adherence to Coding Standards | Prominent CVE |
|---|---|
| CWE-1095: Loop Condition Value Update within the Loop | |
| CWE-1109: Use of Same Variable for Multiple Purposes | |
| CWE-489: Active Debug Code | CVE-2018-14649, CVSSv3.1: 9.8, EPSS: 69.64 (12.12.2023) |
| Ref | Detail |
|---|---|
| [Python 2023] | 3.9 Module Index [online], available from https://docs.python.org/3.9/py-modindex.html [accessed Dec 2024] |
| [mitre.org 2023] | CWE - CWE-1000: Research Concepts [online], available from https://cwe.mitre.org/data/definitions/1000.html [accessed Dec 2024] |
| [OWASP dev 2024] | OWASP Developer Guide [online], available from https://owasp.org/www-project-developer-guide/release/ [accessed Dec 2024] |
| [OWASP 2021] | OWASP Top 10 Report 2021 [online], available from https://owasp.org/www-project-top-ten/ |
| [MITRE Pillar 2024] | Pillar Weakness [online], available form https://cwe.mitre.org/documents/glossary/#Pillar%20Weakness [accessed Dec 2024] |
| [MITRE 2024] | CWE Top 25 [online], available form https://cwe.mitre.org/top25/index.html [accessed Dec 2024] |