-
Notifications
You must be signed in to change notification settings - Fork 106
Conditional code execution can generate unexpected errors
-
Affected Components : builtin
-
Operating System : Linux
-
Python Versions : 2.6.x, 2.7.x
-
Reproducible : Yes
import sys
def test(first_arg, second_arg):
return (first_arg + second_arg)
def main():
if len(sys.argv) > 3:
return test(1, test)
else:
return test(1, 2)
sys.exit(main())
To reproduce the problem copy the source code
in a file and execute the script using the following command syntax:
$ python -OOBRtt test.py
Alternatively you can open python in interactive mode:
$ python -OOBRtt <press enter>
Then copy the lines of code into the interpreter.
And to generate the error issue copy the following command in a terminal and press `Enter```:
python -W error -OOBRtt test.py 0 1 2
No error if the script is executed with no arguments:
python -W error -OOBRtt test.py
No error if the script is executed with one argument:
python -W error -OOBRtt test.py 0
No error if the script is executed with two arguments:
python -W error -OOBRtt test.py 0 1
But if the code is executed by passing three arguments we have an error:
python -W error -OOBRtt test.py 0 1 2
Traceback (most recent call last):
File "test.py", line 12, in <module>
sys.exit(main())
File "test.py", line 8, in main
return test(1, test)
File "test.py", line 4, in test
return first_arg + second_arg
TypeError: unsupported operand type(s) for +: 'int' and 'function'
In python variables are not statically typed therefore is possible to have a valid part of code pointing to another section of the code only under certain conditions, thus escaping normal testing procedures.
A possible solution would be to implement a module to check object type, length and reference, and to raise an exception (TypeError or Value Error) avoiding intermediate operations.
We are not aware on any easy solution other than trying to avoid code structured like the one examined.
[Python builtins][01] [01]:https://docs.python.org/2/library/functions.html
[Python sys module][02] [02]:https://docs.python.org/2/library/sys.html
Main site: pythonsecurity.org
OWASP Page: owasp.org/index.php/OWASP_Python_Security_Project