pySCG: Adding documentation to CWE-175 as part of #531

[s19110]

Adding documentation to CWE-175 as part of #531

[myteron]

code not working, line 12 and 15 are missing locale.CURRENT_LOCALE

[BartyBoi1128]

Left comments with suggestions, In "example03.py" I couldn't leave a suggested change on all the lines but essentially just wondering can we remove one "#" from the comments, just leave it at "#" rather than "##"

[s19110]

Left comments with suggestions, In "example03.py" I couldn't leave a suggested change on all the lines but essentially just wondering can we remove one "#" from the comments, just leave it at "#" rather than "##"

Thank you for the suggestions, I have now merged all of them. As for the "##" in comments, I will change them to a singular "#" and indicate if they are supposed to be console output or something else.

[myteron]

example01.py code does not work. Rest is more or less cosmetic hope I got matching code between .py and .md

[myteron]

Suggested change

	print(word.upper())
	locale.setlocale(locale.LC_ALL, "tr_TR.utf8")
	print(word.upper())
	print(WORD.upper())
	locale.setlocale(locale.LC_ALL, "tr_TR.utf8")
	print(WORD.upper())

[myteron]

Suggested change

	print(word.upper())
	locale.setlocale(locale.LC_ALL, "tr_TR.utf8")
	print(word.upper())
	print(WORD.upper())
	locale.setlocale(locale.LC_ALL, "tr_TR.utf8")
	print(WORD.upper())

[myteron]

I thinks it becomes self explaining what to do once we add the number to type in. output example should be below code

Suggested change

	def compare_number(number):
	input_number = locale.atof(input("Enter a number: "))
	# Test if inputted number equals current number
	return number == input_number
	print(f"Locale is {locale.getlocale()}")
	print(f"Do the numbers match? {compare_number(ORIGINAL_NUMBER)}")
	# Console output:
	# Locale is ('English_Ireland', '1252')
	# Enter a number: 12,345
	# Do the numbers match? False
	# After setting the locale
	locale.setlocale(locale.LC_ALL, 'de_DE.utf8')
	print(f"Locale is {locale.getlocale()}")
	print(f"Do the numbers match? {compare_number(ORIGINAL_NUMBER)}")
	# Console output:
	# Locale is ('de_DE', 'UTF-8')
	# Enter a number: 12,345
	# Do the numbers match? True
	def compare_number(number):
	input_number = locale.atof(input(f"Enter a number {ORIGINAL_NUMBER}: "))
	# Test if inputted number equals current number
	return number == input_number
	print(f"Locale is {locale.getlocale()}")
	print(f"Do the numbers match? {compare_number(ORIGINAL_NUMBER)}")
	# Setting the locale to German
	locale.setlocale(locale.LC_ALL, 'de_DE.utf8')
	print(f"Locale is {locale.getlocale()}")
	print(f"Do the numbers match? {compare_number(ORIGINAL_NUMBER)}")

[myteron]

I think it becomes self explaining once we add the number to type in. Output should be below code example

Suggested change

	def compare_number(number):
	input_number = locale.atof(input("Enter a number: "))
	# Test if inputted number equals current number
	return number == input_number
	print(f"Locale is {locale.getlocale()}")
	print(f"Do the numbers match? {compare_number(ORIGINAL_NUMBER)}")
	# Console output:
	# Locale is ('English_Ireland', '1252')
	# Enter a number: 12,345
	# Do the numbers match? False
	# After setting the locale
	locale.setlocale(locale.LC_ALL, 'de_DE.utf8')
	print(f"Locale is {locale.getlocale()}")
	print(f"Do the numbers match? {compare_number(ORIGINAL_NUMBER)}")
	# Console output:
	# Locale is ('de_DE', 'UTF-8')
	# Enter a number: 12,345
	# Do the numbers match? True
	def compare_number(number):
	input_number = locale.atof(input(f"Enter a number {ORIGINAL_NUMBER}: "))
	# Test if inputted number equals current number
	return number == input_number
	print(f"Locale is {locale.getlocale()}")
	print(f"Do the numbers match? {compare_number(ORIGINAL_NUMBER)}")
	# Console output:
	# Locale is ('English_Ireland', '1252')
	# Enter a number: 12,345
	# Do the numbers match? False
	# After setting the locale
	locale.setlocale(locale.LC_ALL, 'de_DE.utf8')
	print(f"Locale is {locale.getlocale()}")
	print(f"Do the numbers match? {compare_number(ORIGINAL_NUMBER)}")
	# Console output:
	# Locale is ('de_DE', 'UTF-8')
	# Enter a number: 12,345
	# Do the numbers match? True

[myteron]

Suggested change

	The developer should be aware of the text encoding that is used for input data and output data in the program. The code example attempts to use UTF-16 LE encoding to read the LOREM `TextIOWrapper` stream which raises a `UnicodeDecodeError` exception as it was created with UTF-8.
	The developer should be aware of the text encoding that is used for input data and output data in the program. The code example attempts to use `UTF-16 LE` encoding to read the LOREM `TextIOWrapper` stream which raises a `UnicodeDecodeError` exception as it was created with `UTF-8`.

[myteron]

Suggested change

	The correct text encoding, UTF-8 for the LOREM `TextIOWrapper` stream has been included in the program. Ensure the encoding of data is known and explicitly stated when parsing and creating data.
	The correct text encoding, `UTF-8` for the LOREM `TextIOWrapper` stream has been included in the program. Ensure the encoding of data is known and explicitly stated when parsing and creating data.

[myteron]

We are not exploiting anything here, comment is enough

Suggested change

	print(f"{len(output.getvalue().decode('utf-8'))} characters in string")
	#####################
	# exploiting above code example
	#####################
	# 1337 characters in string
	# 1337 characters in string
	print(f"{len(output.getvalue().decode('utf-8'))} characters in string")

[myteron]

Not exploiting anything, comment is enough:

Suggested change

	print(f"{len(output.getvalue().decode('utf-8'))} characters in string")
	#####################
	# exploiting above code example
	#####################
	# 1337 characters in string
	# 1337 characters in string
	print(f"{len(output.getvalue().decode('utf-8'))} characters in string")

[myteron]

Not an exploit, comment is enough

Suggested change

	print(f"{len(output.getvalue().decode('utf-16le'))} characters in string")
	#####################
	# exploiting above code example
	#####################
	# UnicodeDecodeError: 'utf-16-le' codec can't decode byte 0x2e in position 1336: truncated data
	# Below outputs UnicodeDecodeError: 'utf-16-le' codec can't decode byte 0x2e in position 1336: truncated data
	print(f"{len(output.getvalue().decode('utf-16le'))} characters in string")

[myteron]

Not an exploit, comment is enough

Suggested change

	print(f"{len(output.getvalue().decode('utf-16le'))} characters in string")
	#####################
	# exploiting above code example
	#####################
	# UnicodeDecodeError: 'utf-16-le' codec can't decode byte 0x2e in position 1336: truncated data
	# Below outputs UnicodeDecodeError: 'utf-16-le' codec can't decode byte 0x2e in position 1336: truncated data
	print(f"{len(output.getvalue().decode('utf-16le'))} characters in string")