Code Review Doctor

Apr 25

10% of the 666 most popular Python GitHub repos have these f-string bugs

tl;dr We found that 10% of the 666 most popular Python open source GitHub repositories had the following f-string typo bugs: f prefix was missing:"hello {name}"instead of f"hello {name}" . f prefix was written inside the string: "fhello {name}"instead of f"hello {name}" . …

Python

8 min read

Published in System Weakness

·Apr 13

Hacking websites: session hijacking with XSS (and how to protect your Django website)

One vulnerability builds on top of another: a bad actor can perform a series of attacks on your website that starts as a simple XSS attack to trick the browser into executing some Javascipt, and ends with the hacker completely hijacking the victim’s logged in session through stealing the their…

Django

3 min read

Mar 3

Hacking Django: steal passwords and cookies using packet sniffing

Packet sniffing can be used to steal passwords from insecure Django websites. Here’s a demo of such an attack: Stealing credentials and session cookies is easy if the following conditions are met: The target user is on the same network as the attacker The target website is accepting HTTP…

Django

3 min read

Feb 21

5 percent of the 420 python codebases we checked silently skipped tests (so we fixed them)

Duplicate names for tests in the same scope results in some of the tests being skipped: # file with 3 tests (with duplicate names) def test_a(): pass def test_a(): pass def test_a(): pass The tests were written. Lets run them: $ pytest collecting ... tests/test_helpers.py::test_a ✓ 100% ██████████ Results (0.85s)…

Python

5 min read

Feb 16

3% of 666 Python codebases we checked had a silently failing unit test

Lets coin a name for a very special type of unit test: Schroeder’s unit-test: a unit test that passes but fails to test the thing we want to test. This article focuses on our code scanning of 666 Python codebases to detect one such Schroeder’s unit tests. …

Python

4 min read

Feb 9

The JSON trick 25% of Python devs don’t know about

Reading and writing JSON files is a common chore in Python. In fact our analysis of 888 codebases found that 17% of repositories either read from or wrote to JSON files. Of those 150 codebases 25% were making their lives harder than necessary by not using a built-in JSON feature…

Python

3 min read

Jan 31

Hacking Django websites: Man In The Middle attack

A website served via HTTP is vulnerable to Man In The Middle (MITM) attacks: a hacker can get between your browser and the server responding to the browser’s requests. The response or request can be amended for malicious intent. A Man could get In The Middle after an unsuspecting user…

Django

3 min read

Jan 29

Hacking Django websites with Cross Site Request Forgery

Cross Site Request Forgery is when a malicious site can cause a visitor’s browser to make a request to your server that causes a change on your server. If one of your logged in users accesses a malicious website containing Cross Site Forgery Request code then your website can be…

Python

4 min read

Hacking Django websites with Cross Site Request Forgery

Jan 28

666 Python repos checked. 5409 open(…) calls. 11% were never closed!

It’s a problem that 11% of files are not closed properly as leaving files open degrades application performance and increases the risk of unexpected side effects. How did we find this statistic? At CodeReview.doctor we run static analysis checks on codebases, and we collect stats on the public repos. We…

Python

3 min read

Published in Dev Genius

·Jan 7

5% of 666 Python repos had comma typos (including Tensorflow, and PyTorch, Sentry, and V8)

We found that 5% of the 666 Python open source GitHub repositories we checked had the following three comma-related bugs caused by typos: Too few commas Accidentally missed comma from string in list/tuple/set, resulting in unwanted string concatenation.

Python

5 min read