do not let all users write permissions

Docs > Plateforme de sécurité Datadog > Code Security > Static Code Analysis (SAST) > SAST Rules > do not let all users write permissions

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

ID: python-security/file-write-others

Language: Python

Severity: Warning

Category: Security

CWE: 280

Description

Make sure that programs do not let write permissions for all users. When using os.chmod, the user should never use S_IWOTH that gives the permission to all users to write the file on the filesystem.

Instead, this permission should be removed, and proper control access should be configured.

See the following related CWE:

CWE-275 category - Permission Issues
CWE-280 - Improper Handling of Insufficient Permissions or Privileges

Non-Compliant Code Examples

import stat

path = "/path/to/file"
os.chmod(path, stat.S_IROTH | stat.S_IWOTH | stat.S_IXOTH)

Compliant Code Examples

import stat

path = "/path/to/file"
os.chmod(path, stat.S_IROTH | stat.S_IXOTH)  # no write by others