The Python json module provides a way to parse and generate JSON data.
However, it is important to be aware that malicious JSON strings can be used
to attack applications that use the json module. For example, a malicious
JSON string could be used to cause the decoder to consume considerable CPU
and memory resources, which could lead to a denial-of-service attack.

Example

import json


json.loads('["foo", {"bar":["baz", null, 1.0, 2]}]')

??? example "Example Output"
> precli --enable=all tests/unit/rules/python/stdlib/json/examples/json_loads.py ⚠️ Warning on line 4 in tests/unit/rules/python/stdlib/json/examples/json_loads.py PY009: Deserialization of Untrusted Data Potential unsafe usage of 'json.loads' that can allow instantiation of arbitrary objects.

Remediation

To avoid this vulnerability, it is important to only parse JSON data from
trusted sources. If you are parsing JSON data from an untrusted source, you
should first sanitize the data to remove any potential malicious code.

Default Configuration

enabled = false
level = "warning"

See also

!!! info
- json — JSON encoder and decoder
- CWE-502: Deserialization of Untrusted Data

New in version 0.1.0

Assertions are typically used during the development phase to catch logic
errors and conditions that should never occur. However, relying on assertions
for security checks or other critical runtime validations is not recommended
because:

• Assertions can be disabled in Python with the -O (optimize) and -OO flags,
  which remove assert statements and sometimes docstrings. If critical checks
  are implemented using assertions, this could lead to security vulnerabilities
  being exposed in production environments where optimizations are enabled.

• Assertions throw exceptions if the condition fails, which, if not properly
  handled, can lead to crashes or other unintended behavior in the application.

Using assertions for non-critical checks during development is common, but for
production code, especially for input validation, error handling, or other
security-sensitive operations, it's important to use proper error handling
mechanisms and validations that do not get removed during optimization.

Examples

def foobar(a: str = None):
    assert a is not None
    return f"Hello {a}"

foobar("World")

??? example "Example Output"
> precli tests/unit/rules/python/stdlib/assert/examples/assert.py ⚠️ Warning on line 2 in tests/unit/rules/python/stdlib/assert/examples/assert.py PY001: Improper Check or Handling of Exceptional Conditions Assert statements are disabled when optimizations are enabled.

Remediation

Use proper error handling mechanism appropriate for production code.

def foobar(a: str = None):
    if a is not None:
        return f"Hello {a}"

foobar("World")

Default Configuration

enabled = false
level = "warning"

See also

!!! info
- Simple statements — Python documentation
- CWE-617: Reachable Assertion
- CWE-703: Improper Check or Handling of Exceptional Conditions

New in version 0.3.8