diff --git a/docs/Secure-Coding-Guide-for-Python/CWE-707/CWE-117/compliant01.py b/docs/Secure-Coding-Guide-for-Python/CWE-707/CWE-117/compliant01.py
index 5e69b77c3..13e12581f 100644
--- a/docs/Secure-Coding-Guide-for-Python/CWE-707/CWE-117/compliant01.py
+++ b/docs/Secure-Coding-Guide-for-Python/CWE-707/CWE-117/compliant01.py
@@ -1,26 +1,33 @@
# SPDX-FileCopyrightText: OpenSSF project contributors
# SPDX-License-Identifier: MIT
-""" Compliant Code Example """
+"""Compliant Code Example"""
+
import logging
import re
+# Allow only ASCII letters, digits, underscore, dot, and hyphen; max 64 chars
+_ALLOWED_USER = re.compile(r"^[A-Za-z0-9._-]{1,64}$")
+
-def allowed_chars(user):
- """Verify only allowed characters are used"""
- if bool(re.compile(r"\w+").fullmatch(user)):
- return True
- return False
+def is_allowed_username(user: str) -> bool:
+ """Return True if username matches the strict allow-list."""
+ return bool(_ALLOWED_USER.fullmatch(user))
def log_authentication_failed(user):
- """Simplified audit logging missing RFC 5424 details"""
- if not allowed_chars(user):
- logging.critical("Login attempt with non-allowed characters in user name: '%s'", user)
+ """Simplified audit logging (example)"""
+ if not is_allowed_username(user):
+ # Safe summary: %r escapes CR/LF so the log remains one line
+ logging.warning("Rejected login attempt: invalid username=%r", user)
+ return
logging.warning("User login failed for: '%s'", user)
#####################
# attempting to exploit above code example
#####################
-log_authentication_failed("""foo
-WARNING:root:User login failed for: administrator""")
+log_authentication_failed("guest'\nWARNING:root:User login failed for: 'administrator")
+
+
+# TODO: Production — keep sink-side neutralization (escape CR/LF) even with validation,
+# prefer structured JSON logs.
diff --git a/docs/Secure-Coding-Guide-for-Python/CWE-707/CWE-117/noncompliant01.py b/docs/Secure-Coding-Guide-for-Python/CWE-707/CWE-117/noncompliant01.py
index 2105df82c..228380faa 100644
--- a/docs/Secure-Coding-Guide-for-Python/CWE-707/CWE-117/noncompliant01.py
+++ b/docs/Secure-Coding-Guide-for-Python/CWE-707/CWE-117/noncompliant01.py
@@ -1,6 +1,7 @@
# SPDX-FileCopyrightText: OpenSSF project contributors
# SPDX-License-Identifier: MIT
-""" Non-compliant Code Example """
+"""Non-compliant Code Example"""
+
import logging
@@ -12,5 +13,4 @@ def log_authentication_failed(user):
#####################
# attempting to exploit above code example
#####################
-log_authentication_failed("""foo
-WARNING:root:User login failed for: administrator""")
+log_authentication_failed("guest'\nWARNING:root:User login failed for: 'administrator")
diff --git a/docs/Secure-Coding-Guide-for-Python/readme.md b/docs/Secure-Coding-Guide-for-Python/readme.md
index c46ad3d74..3f302957a 100644
--- a/docs/Secure-Coding-Guide-for-Python/readme.md
+++ b/docs/Secure-Coding-Guide-for-Python/readme.md
@@ -110,7 +110,7 @@ It is __not production code__ and requires code-style or python best practices t
|:----------------------------------------------------------------|:----|
|[CWE-78: Improper Neutralization of Special Elements Used in an OS Command ("OS Command Injection")](CWE-707/CWE-78/README.md)|[CVE-2024-43804](https://www.cvedetails.com/cve/CVE-2024-43804/),