code-review-pythonlisted

# Python security code review ## When it applies You're reading Python source (a repo, a PR, a service). This is the language-specific companion to `code-review-methodology` — the exact sinks and framework gotchas to grep and trace. ## Why it works Most severe Python bugs come from a known set of sinks plus framework misuse. Grep the sinks, trace each argument to a user source, and check the framework's safe-vs-unsafe API was used. ## Sinks & patterns (grep, then trace to user input) - **Command exec**: `os.system`, `subprocess.*(..., shell=True)`, `os.popen` — shell=True + user input = injection. - **Code eval**: `eval`, `exec`, `pickle.loads`, `yaml.load` (without `SafeLoader`), `marshal` — deserialization/eval RCE. - **SQL**: raw/f-string queries, `.raw()`, `.extra()`, `cursor.execute("... %s" % x)` — use params, not formatting. - **SSRF**: `requests.get`/`urllib`/`httpx` on a user URL (→ `web-ssrf`). - **Path/upload**: `open`/`send_file`/`os.path.join` with user paths (traversal); zip extraction (zip-slip). - **Template (SSTI)**: `render_template_string`, Jinja from user input (→ `web-ssti`). - **Secrets**: hardcoded keys/passwords; `DEBUG=True` in prod. ## Framework specifics - **Django**: `mark_safe`/`|safe` (XSS), `.raw()`/`.extra()` (SQLi), `DEBUG=True` (info leak), `SECRET_KEY` exposure (session forgery), missing `@login_required`/object-level checks (IDOR), `ALLOWED_HOSTS='*'`, pickle session serializer. - **Flask**: `render_template_string` (SSTI), `debug=T