full-disclosure - [FD] Python's official documentation contains textbook example of insecure code (XSS)

Open Source and information security mailing list archives

Message-ID: <CAGUWgD8OU9F5GX2cgYigM4NP_Hs7YmZRPD8b1Rv2kY1XwcTraA@mail.gmail.com>
Date: Tue, 18 Feb 2025 11:46:54 +0200
From: Georgi Guninski <gguninski@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Python's official documentation contains textbook example of
 insecure code (XSS)

Python's official documentation contains textbook example of insecure code (XSS)

Date: 2025-02-18
Author: Georgi Guninski

>From the official Python 3.12 documentation on the CGI module [1]

===
form = cgi.FieldStorage()
if "name" not in form or "addr" not in form:
    print("<H1>Error</H1>")
    print("Please fill in the name and addr fields.")
    return
print("<p>name:", form["name"].value)
print("<p>addr:", form["addr"].value)
...further form processing here...
===

This is a textbook example of the Cross Site Scripting (XSS) vulnerability.

The insecure code from the Python developers might have large impact
on Python web development as a whole.

It possibly contributes to XSS vulnerability in first page on google,
Chatgpt [3] and Deepseek [4] where AI writes textbook insecure code.
Web search on Debian's source code returns many results for `import
cgi`.

If you don't Read The Fine Manual then you are uninformed, if you read
it you are disinformed.

I am surprised this survived so long.

Mitigation:
CGI is Deprecated since version 3.11, removed in version 3.13. [2]

Counter Mitigation: CGI started in the 90's, probably significant
amount of legacy Python CGI.

[1] https://docs.python.org/3.12/library/cgi.html
[2] https://docs.python.org/3/library/cgi.html
[3] https://www.linkedin.com/pulse/ai-chatgpt-writes-insecure-code-georgi-guninski
[4] https://www.linkedin.com/pulse/deepseek-writes-textbook-insecure-code-2025-01-28-georgi-guninski-uuzcf
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives