Python's official documentation contains textbook example of insecure code (XSS)

Date: Python's official documentation contains textbook example of insecure code (XSS)

Date: 2025-02-18
Author: Georgi Guninski

>From the official Python 3.12 documentation on the CGI module [1]

===
form = cgi.FieldStorage()
if "name" not in form or "addr" not in form:
print("<H1>Error</H1>")
print("Please fill in the name and addr fields.")
return
print("<p>name:", form["name"].value)
print("<p>addr:", form["addr"].value)
...further form processing here...
===

This is a textbook example of the Cross Site Scripting (XSS) vulnerability.

The insecure code from the Python developers might have large impact
on Python web development as a whole.

It possibly contributes to XSS vulnerability in first page on google,
Chatgpt [3] and Deepseek [4] where AI writes textbook insecure code.
Web search on Debian's source code returns many results for `import
cgi`.


If you don't Read The Fine Manual then you are uninformed, if you read
it you are disinformed.

I am surprised this survived so long.

Mitigation:
CGI is Deprecated since version 3.11, removed in version 3.13. [2]

Counter Mitigation: CGI started in the 90's, probably significant
amount of legacy Python CGI.

[1] https://docs.python.org/3.12/library/cgi.html
[2] https://docs.python.org/3/library/cgi.html
[3] https://www.linkedin.com/pulse/ai-chatgpt-writes-insecure-code-georgi-guninski
[4] https://www.linkedin.com/pulse/deepseek-writes-textbook-insecure-code-2025-01-28-georgi-guninski-uuzcf