Experiment Notes
Identifying details have been
removed to
protect the innocent.
Slide 29
Slide 29 text
Issues
found:
Slide 30
Slide 30 text
Assertions
Slide 31
Slide 31 text
70 @percent.setter
71 def percent(self, value):
72 assert value >= 0
73 assert value <= 100
Assertions
Slide 32
Slide 32 text
>> Issue: Use of assert detected. The
enclosed code will be removed when
compiling to optimised byte code.
70 @percent.setter
71 def percent(self, value):
72 assert value >= 0
73 assert value <= 100
Assertions
>> Issue: Audit url open for permitted
schemes. Allowing use of file:/ or custom
schemes is often unexpected.
165 try:
166 conn = urllib2.urlopen(request)
Opening URLs
>> Issue: Use of insecure and deprecated
function (mktemp).
291 listpath = tempfile.mktemp(“.tmp")
Temporary Files
Slide 45
Slide 45 text
Loading XML
Slide 46
Slide 46 text
47 root = ElementTree.fromstring(content)
Loading XML
Slide 47
Slide 47 text
>> Issue: Using ElementTree.fromstring to
parse untrusted XML data is known to be
vulnerable to XML attacks. Replace with
its defusedxml equivalent function.
47 root = ElementTree.fromstring(content)
Loading XML