From 5aa384f99efadbb27becd26577af341c733bd979 Mon Sep 17 00:00:00 2001 From: Maksim Grebeniuk <122789225+maksim-grebeniuk-sonarsource@users.noreply.github.com> Date: Tue, 8 Aug 2023 11:11:03 +0200 Subject: [PATCH] Modify rule S2317: LaYC format (#2677) --- rules/S2317/python/rule.adoc | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/rules/S2317/python/rule.adoc b/rules/S2317/python/rule.adoc index a2624bef45..530293541d 100644 --- a/rules/S2317/python/rule.adoc +++ b/rules/S2317/python/rule.adoc @@ -1,19 +1,29 @@ +This rule raises an issue when the exec statement is used. + == Why is this an issue? Use of the ``++exec++`` statement could be dangerous, and should be avoided. Moreover, the ``++exec++`` statement was removed in Python 3.0. Instead, the built-in ``++exec()++`` function can be used. +Use of the ``++exec++`` statement is strongly discouraged for several reasons such as: -=== Noncompliant code example +* *Security Risks:* Executing code from a string opens up the possibility of code injection attacks. +* *Readability and Maintainability:* Code executed with ``++exec++`` statement is often harder to read and understand since it is not explicitly written in the source code. +* *Performance Implications:* The use of ``++exec++`` statement can have performance implications since the code is compiled and executed at runtime. +* *Limited Static Analysis:* Since the code executed with ``++exec++`` statement is only known at runtime, static code analysis tools may not be able to catch certain errors or issues, leading to potential bugs. -[source,python] +=== Code examples + +==== Noncompliant code example + +[source,python,diff-id=1,diff-type=noncompliant] ---- exec 'print 1' # Noncompliant ---- -=== Compliant solution +==== Compliant solution -[source,python] +[source,python,diff-id=1,diff-type=compliant] ---- exec('print 1') ----