Contents
- file_input.py
- fixed_input.py
- form.html
- purchase.html
- security_bug.py
file_input.py 1/5
[top][prev][next]
# Example of providing a validated list of input
# Sara Sprenkle
def main():
# the list of valid files user can choose from
VALID_LIST= ["highschool.txt", "college.txt", "family.txt"]
VALID_LIST.sort()
print
print "Which of the following social network files do you want to process?"
x = 1
for filename in VALID_LIST:
print "\t%d: %s"%(x, filename)
x+=1
choicestr = raw_input("Select the file by number: ")
print
try:
choice = int(choicestr)
if choice < 1 or choice > len(VALID_LIST):
print "ERROR:", choice, "is not a valid selection."
else:
print "Processing file %d: %s" % (choice, VALID_LIST[choice-1])
except:
print "ERROR: selection must be an integer."
main()
fixed_input.py 2/5
[top][prev][next]
# Example of addressing the input() security bug in Python
# Sara Sprenkle
total = 0
numDeposits = input("How many deposits are there? ")
if numDeposits <= 0:
print "Error: Number of deposits must be positive"
sys.exit(1)
for x in xrange(numDeposits):
depositString = raw_input("Enter deposit " + str(x) + ": ")
try:
deposit = float(depositString)
total += deposit
except:
# Note that one less deposit will be included in total; does not
# reprompt for deposit
print "Error: the deposit must be an float."
print "The total amount deposited is $%.2f." % total
form.html 3/5
[top][prev][next]
<html>
<head>
<title>Purchase Books</title>
</head>
<body>
<h1>Purchase Books</h1>
<table>
<tr><th>Title:</th><td>Green Eggs and Ham</td></tr>
<tr><th>Author:</th><td>Dr. Seuss</td></tr>
<tr><th>Price:</th><td>$10.00</td></tr>
</table>
<form method=post action="http://www.cs.wlu.edu/~sprenkle/cs111/security/purchase.html">
<p>How many books would you like to purchase?
<select name=books>
<option value="1">1</option>
<option value="2">2</option>
<option value="-3">-3</option>
<option value="4">4</option>
<option value="5">5</option>
<option value="6">6</option>
</select>
<br/><input type="submit" name="submit" value="Purchase Books"/>
</form>
<p>
<!--<a href="purchase.html">Purchase Books</a>-->
</body>
</html>
purchase.html 4/5
[top][prev][next]
<html>
<head>
<title>Confirm Purchase</title>
</head>
<body>
<h1>Confirm Purchase</h1>
<p>You have ordered <b>-3</b> books! Your subtotal is <b>$-30.00</b>.
<table>
<tr><th>Subtotal:</th><td>$-30.00</td></tr>
<tr><th>Shipping:</th><td>$6.00</td></tr>
<tr><th>Tax: (5%)</th><td>$-1.50</td></tr>
<tr><th>Total:</th><td>$-25.50</td></tr>
</table>
<form>
<input type=button name="submit" value="Submit">
</form>
</body>
</html>
security_bug.py 5/5
[top][prev][next]
# Example of security bug in python with input() function in Python
# Sara Sprenkle
total = 0
numDeposits = input("How many deposits are there? ")
if numDeposits <= 0:
print "Error: Number of deposits must be positive"
sys.exit(1)
for x in xrange(numDeposits):
# Try entering something like "total * 2" for the second deposit
total += input("Enter deposit " + str(x) + ": ")
print "The total amount deposited is $%.2f." % total
Generated by GNU enscript 1.6.4.