use secrets package over random package

Docs > Code Analysis > Static Analysis Rules > use secrets package over random package

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

ID: python-security/avoid-random

Language: Python

Severity: Error

Category: Security

CWE: 330

Description

Make sure to use values that are actually random. The random module in Python should generally not be used and replaced with the secrets module, as noted in the official Python documentation.

Learn More

Non-Compliant Code Examples

from random import randrange

randrange(10) # # randrange is not actually random

from random import random

v = random() # random is not actually random

import random

n = random.randrange(10) # randrange is not actually random

import random

n = random.random(1) # randrange is not actually random

import random

n = random.random() # randrange is not actually random

Compliant Code Examples

n = random.random()

How to use this rule

1
2
rulesets:
  - python-security     # Rules to enforce Python security.

Create a static-analysis.datadog.yml with the content above at the root of your repository
Use our free IDE Plugins or add Code Analysis scans to your CI pipelines
Get feedback on your code

For more information, please read the Code Analysis documentation

VS Code Extension

Identify code vulnerabilities directly in your
VS Code editor

JetBrains Plugin

Identify code vulnerabilities directly in
JetBrains products