Secure Coding One Stop Shop for Python
ⓘ NOTE: This is a draft. Contributions welcome!
Web: https://best.openssf.org/Secure-Coding-Guide-for-Python/
GitHub: https://github.com/ossf/wg-best-practices-os-developers/tree/main/docs/Secure-Coding-Guide-for-Python
An initiative by the OpenSSF to provide new Python programmers a resource to study secure coding in CPython >= 3.9 with working code examples.
Documentation is written in academic style to support security researchers while using plain English to cater for an international audience.
Python modules outside of the Python Module Index [Python 2023] are specifically not covered by this document.
Please join us, see contributing
Disclaimer
Content comes WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, as stated in the license text CC-BY-4.0 for documentation and MIT. Following or using the documentation and or code is at your own risk. Code examples are intended purely for educational use and not for products in parts or in full. Code examples are NOT to be used to cause harm of any kind to anyone or anything.
Introduction
Every person writing code shall study the following:
- OWASP Developer Guide [OWASP dev 2024]
- OWASP Top 10 Report [OWASP 2021]
- CWE Top 25 [MITRE 2024]
Secure Coding Standard for Python
Code examples are written to explain security design with as little code as possible. None of the code examples are intended to be used ‘as is’ for production. Using the code is at your own risk!
Code file naming conventions:
noncompliantXX.pyanti-pattern, bad programming practice.compliantXX.pymitigation or removal of ONLY the described risk.exampleXX.pyto allow understanding the documented behaviour.
It is not production code and requires code-style or python best practices to be added such as:
- Inline documentation
- Custom exceptions
- Full descriptive variable names
- Line length limit
- Proper logging instead of printing to
stdout - Secure coding compliance outside of described issue
Biblography
| Ref | Detail |
|---|---|
| [Python 2023] | 3.9 Module Index [online], available from https://docs.python.org/3.9/py-modindex.html [accessed Dec 2024] |
| [mitre.org 2023] | CWE - CWE-1000: Research Concepts [online], available from https://cwe.mitre.org/data/definitions/1000.html [accessed Dec 2024] |
| [OWASP dev 2024] | OWASP Developer Guide [online], available from https://owasp.org/www-project-developer-guide/release/ [accessed Dec 2024] |
| [OWASP 2021] | OWASP Top 10 Report 2021 [online], available from https://owasp.org/www-project-top-ten/ |
| [MITRE Pillar 2024] | Pillar Weakness [online], available form https://cwe.mitre.org/documents/glossary/#Pillar%20Weakness [accessed Dec 2024] |
| [MITRE 2024] | CWE Top 25 [online], available form https://cwe.mitre.org/top25/index.html [accessed Dec 2024] |
Contributors
This guide was jointly developed by the following group of awesome contributors:
- Andrew Costello
- Bartlomiej Karas
- David A. Wheeler
- Dean Wiley
- Georg Kunz
- Helge Wehder
- Hubert Daniszewski
- Ketki Davda
- Kyrylo Yatsenko
- Michael Scovetta
- Noah Spahn
- Tom McDermott
- Viktor Szépe