pySCG pillar 664 base 409 #944

myteron · 2025-07-15T12:28:45Z

Adding doc for CWE409 as part of pySCG: Doc2GitHub, moving code from an internal confluence to this GitHub space. #531
Updated TEMPLATE_README.md with html table tags

Signed-off-by: Helge Wehder <[email protected]>

s19110 · 2025-07-17T10:07:18Z

reviewing

dwiley258 · 2025-07-17T10:29:55Z

docs/Secure-Coding-Guide-for-Python/CWE-664/CWE-409/README.md

+
+## Non-Compliant Code Example - No File Validation
+
+The `noncompliant01.py` example simply extracts all the files in the archive without performing any verification. The `extractall()` method will attempt to normalize the path name. Any archive from an untrusted source should be inspected prior to extraction. There is no attempt to control where the files are extracted, which is the script current working directory.


In this confluence it is written
"The extractall() method will attempt to normalize the path name but any archive"
the way it is here doesn't read right to me.

s19110

Left some minor comments and suggestions.

s19110 · 2025-07-17T10:34:31Z

docs/Secure-Coding-Guide-for-Python/templates/README_TEMPLATE.md

+    </tr>
+    <tr>
+        <td><a href="http://cwe.mitre.org/">MITRE CWE</a></td>
+        <td>Base: <a href="https://cwe.mitre.org/data/definitions/1335.html">[CWE-1335: Incorrect Bitwise Shift of Integer (4.12)]</a></td>


I think it's worth keeping the info about CWEs being marked as either Base or Class. New contributors may not realize you have to check that on the official website.

Suggested change

<td>Base: <a href="https://cwe.mitre.org/data/definitions/1335.html">[CWE-1335: Incorrect Bitwise Shift of Integer (4.12)]</a></td>

<td>Base or Class (choose which one it is based on the abstraction on the CWE page): <a href="https://cwe.mitre.org/data/definitions/1335.html">[CWE-1335: Incorrect Bitwise Shift of Integer (4.12)]</a></td>

s19110 · 2025-07-17T10:35:41Z

docs/Secure-Coding-Guide-for-Python/templates/README_TEMPLATE.md

+        <td>[SEI CERT C 2025]</td>
+        <td>CERT C Coding Standard [online]. Available from: <a href=https://www.securecoding.cert.org/confluence/display/seccode/CERT+C+Coding+Standard>https://www.securecoding.cert.org/confluence/display/seccode/CERT+C+Coding+Standard</a> [Accessed 6 May 2025]</td>
+    </tr>
+</table>


The link to the reference guide is missing.

Suggested change

</table>

</table>

When writing bibliography, follow the [Harvard reference guide](https://dkit.ie.libguides.com/harvard/citing-referencing)

s19110 · 2025-07-17T10:38:59Z

docs/Secure-Coding-Guide-for-Python/CWE-703/CWE-476/compliant03.py

This file seems unrelated to the pull request. I can't find this CWE on the main branch. Was it added by accident or will the readme and the other code examples be added later?

s19110 · 2025-07-17T10:51:07Z

docs/Secure-Coding-Guide-for-Python/CWE-664/CWE-409/README.md

+
+The `noncompliant01.py` code will extract any quantity of payloads. With a unmodified `example01.py` we get only `4 x 150MB` `zipbombfileX.txt`'s that are much bigger than the `0.58MB` `zip_attack_test.zip` archive.
+
+The directory traversal payload will try to extract a `\Temp\zip_slip_windows.txt` for Windows and a `/tmp/zip_slip_posix.txt` for Unix based systems. Depending on the zip library in use the files may either end up in their indented target, under the same directory as the `zipbombfile.txt` files, or not at all.


Indented means it has a zigzag pattern, like Python code where we change the indents for different code blocks! I think you meant "intended":

Suggested change

The directory traversal payload will try to extract a `\Temp\zip_slip_windows.txt` for Windows and a `/tmp/zip_slip_posix.txt` for Unix based systems. Depending on the zip library in use the files may either end up in their indented target, under the same directory as the `zipbombfile.txt` files, or not at all.

The directory traversal payload will try to extract a `\Temp\zip_slip_windows.txt` for Windows and a `/tmp/zip_slip_posix.txt` for Unix based systems. Depending on the zip library in use the files may either end up in their intended target, under the same directory as the `zipbombfile.txt` files, or not at all.

s19110 · 2025-07-17T11:04:01Z

docs/Secure-Coding-Guide-for-Python/CWE-664/CWE-409/README.md

+
+Experiment with the code by varying the `MAXSIZE`.
+
+The `noncompliant02.py` code example tries to check the file_size from the `ZipInfo`  instances provided by the `infolist()` method from `ZipFile`. This information is read from the `zip` archive metadata, so it is not reliable and can be forged by an attacker. The `extract()` method will attempt to normalize the path name. Again, there is no attempt to control where the files are extracted to in order to prevent traversal attacks. The underlaying zip library may or may not prevent traversal attacks.


Backticks + spelling fix:

Suggested change

The `noncompliant02.py` code example tries to check the file_size from the `ZipInfo` instances provided by the `infolist()` method from `ZipFile`. This information is read from the `zip` archive metadata, so it is not reliable and can be forged by an attacker. The `extract()` method will attempt to normalize the path name. Again, there is no attempt to control where the files are extracted to in order to prevent traversal attacks. The underlaying zip library may or may not prevent traversal attacks.

The `noncompliant02.py` code example tries to check the `file_size` from the `ZipInfo` instances provided by the `infolist()` method from `ZipFile`. This information is read from the `zip` archive metadata, so it is not reliable and can be forged by an attacker. The `extract()` method will attempt to normalize the path name. Again, there is no attempt to control where the files are extracted to in order to prevent traversal attacks. The underlying zip library may or may not prevent traversal attacks.

s19110 · 2025-07-17T11:11:13Z

docs/Secure-Coding-Guide-for-Python/CWE-664/CWE-409/README.md

+
+```
+
+Depending on the underlaying zip library we should see `noncompliant02.py` prevent a zip bomb but not a traversal attack.


Typo:

Suggested change

Depending on the underlaying zip library we should see `noncompliant02.py` prevent a zip bomb but not a traversal attack.

Depending on the underlying zip library we should see `noncompliant02.py` prevent a zip bomb but not a traversal attack.

s19110 · 2025-07-17T11:24:18Z

docs/Secure-Coding-Guide-for-Python/CWE-664/CWE-409/compliant01.py

 class ZipExtractException(Exception):
    """Custom Exception"""


Couldn't we use the built-in ValueError instead of creating a custom exception with no distinct characteristics?

s19110 · 2025-07-17T11:37:40Z

docs/Secure-Coding-Guide-for-Python/CWE-664/CWE-409/compliant01.py

+        ZipExtractException: If there are to big files
+        ZipExtractException: If a directory traversal is detected
+    """
+    # TODO: avoid exposing sensitive data to a lesser trusted entity via errors


We could reference CWE-209 to give an example of how to do it once that rule gets merged :D

myteron added 4 commits July 15, 2025 11:50

review draft

fe28c2b

Signed-off-by: Helge Wehder <[email protected]>

pySCG: adding doc for CWE-664_CWE-409 as part of ossf#531

274d21b

Signed-off-by: Helge Wehder <[email protected]>

pySCG: adding doc for CWE-664_CWE-409 as part of ossf#531

c5cd02e

Signed-off-by: Helge Wehder <[email protected]>

pySCG: adding doc for CWE-664_CWE-409 as part of ossf#531

6adc36d

Signed-off-by: Helge Wehder <[email protected]>

myteron added the Product: Python Hardening Guide label Jul 15, 2025

fixed md lint errors

c83dc5e

Signed-off-by: Helge Wehder <[email protected]>

dwiley258 reviewed Jul 17, 2025

View reviewed changes

s19110 reviewed Jul 17, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

pySCG pillar 664 base 409 #944

pySCG pillar 664 base 409 #944

Uh oh!

myteron commented Jul 15, 2025

Uh oh!

s19110 commented Jul 17, 2025

Uh oh!

dwiley258 Jul 17, 2025

Uh oh!

s19110 left a comment

Uh oh!

s19110 Jul 17, 2025

Uh oh!

s19110 Jul 17, 2025

Uh oh!

s19110 Jul 17, 2025

Uh oh!

s19110 Jul 17, 2025

Uh oh!

s19110 Jul 17, 2025

Uh oh!

s19110 Jul 17, 2025

Uh oh!

s19110 Jul 17, 2025

Uh oh!

s19110 Jul 17, 2025

Uh oh!

Uh oh!


		## Non-Compliant Code Example - No File Validation

		The `noncompliant01.py` example simply extracts all the files in the archive without performing any verification. The `extractall()` method will attempt to normalize the path name. Any archive from an untrusted source should be inspected prior to extraction. There is no attempt to control where the files are extracted, which is the script current working directory.

	<td>Base: <a href="https://cwe.mitre.org/data/definitions/1335.html">[CWE-1335: Incorrect Bitwise Shift of Integer (4.12)]</a></td>
	<td>Base or Class (choose which one it is based on the abstraction on the CWE page): <a href="https://cwe.mitre.org/data/definitions/1335.html">[CWE-1335: Incorrect Bitwise Shift of Integer (4.12)]</a></td>

	</table>
	</table>
	When writing bibliography, follow the [Harvard reference guide](https://dkit.ie.libguides.com/harvard/citing-referencing)


		The `noncompliant01.py` code will extract any quantity of payloads. With a unmodified `example01.py` we get only `4 x 150MB` `zipbombfileX.txt`'s that are much bigger than the `0.58MB` `zip_attack_test.zip` archive.

		The directory traversal payload will try to extract a `\Temp\zip_slip_windows.txt` for Windows and a `/tmp/zip_slip_posix.txt` for Unix based systems. Depending on the zip library in use the files may either end up in their indented target, under the same directory as the `zipbombfile.txt` files, or not at all.


		Experiment with the code by varying the `MAXSIZE`.

		The `noncompliant02.py` code example tries to check the file_size from the `ZipInfo` instances provided by the `infolist()` method from `ZipFile`. This information is read from the `zip` archive metadata, so it is not reliable and can be forged by an attacker. The `extract()` method will attempt to normalize the path name. Again, there is no attempt to control where the files are extracted to in order to prevent traversal attacks. The underlaying zip library may or may not prevent traversal attacks.


		```

		Depending on the underlaying zip library we should see `noncompliant02.py` prevent a zip bomb but not a traversal attack.

	Depending on the underlaying zip library we should see `noncompliant02.py` prevent a zip bomb but not a traversal attack.
	Depending on the underlying zip library we should see `noncompliant02.py` prevent a zip bomb but not a traversal attack.

pySCG pillar 664 base 409 #944

Are you sure you want to change the base?

pySCG pillar 664 base 409 #944

Uh oh!

Conversation

myteron commented Jul 15, 2025

Uh oh!

s19110 commented Jul 17, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

s19110 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!