Python's official documentation contains textbook example of insecure code (XSS)
Date: 2025-02-18
Author: Georgi Guninski
>From the official Python 3.12 documentation on the CGI module [1]
===
form = cgi.FieldStorage()
if "name" not in form or "addr" not in form:
print("<H1>Error</H1>")
print("Please fill in the name and addr fields.")
return
print("<p>name:", form["name"].value)
print("<p>addr:", form["addr"].value)
...further form processing here...
===
This is a textbook example of the Cross Site Scripting (XSS) vulnerability.
The insecure code from the Python developers might have large impact
on Python web development as a whole.
It possibly contributes to XSS vulnerability in first page on google,
Chatgpt [3] and Deepseek [4] where AI writes textbook insecure code.
Web search on Debian's source code returns many results for `import
cgi`.
If you don't Read The Fine Manual then you are uninformed, if you read
it you are disinformed.
I am surprised this survived so long.
Mitigation:
CGI is Deprecated since version 3.11, removed in version 3.13. [2]
Counter Mitigation: CGI started in the 90's, probably significant
amount of legacy Python CGI.
[1] https://docs.python.org/3.12/library/cgi.html
[2] https://docs.python.org/3/library/cgi.html
[3]
https://www.linkedin.com/pulse/ai-chatgpt-writes-insecure-code-georgi-guninski
[4]
https://www.linkedin.com/pulse/deepseek-writes-textbook-insecure-code-2025-01-28-georgi-guninski-uuzcf
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
