Python 3.12 Documentation Cross Site Scripting

Python's official documentation contains textbook example of insecure code (XSS)
    
    Date: 2025-02-18
    Author: Georgi Guninski
    
    >From the official Python 3.12 documentation on the CGI module [1]
    
    ===
    form = cgi.FieldStorage()
    if "name" not in form or "addr" not in form:
        print("<H1>Error</H1>")
        print("Please fill in the name and addr fields.")
        return
    print("<p>name:", form["name"].value)
    print("<p>addr:", form["addr"].value)
    ...further form processing here...
    ===
    
    This is a textbook example of the Cross Site Scripting (XSS) vulnerability.
    
    The insecure code from the Python developers might have large impact
    on Python web development as a whole.
    
    It possibly contributes to XSS vulnerability in first page on google,
    Chatgpt [3] and Deepseek [4] where AI writes textbook insecure code.
    Web search on Debian's source code returns many results for `import
    cgi`.
    
    
    If you don't Read The Fine Manual then you are uninformed, if you read
    it you are disinformed.
    
    I am surprised this survived so long.
    
    Mitigation:
    CGI is Deprecated since version 3.11, removed in version 3.13. [2]
    
    Counter Mitigation: CGI started in the 90's, probably significant
    amount of legacy Python CGI.
    
    [1] https://docs.python.org/3.12/library/cgi.html
    [2] https://docs.python.org/3/library/cgi.html
    [3] https://www.linkedin.com/pulse/ai-chatgpt-writes-insecure-code-georgi-guninski
    [4] https://www.linkedin.com/pulse/deepseek-writes-textbook-insecure-code-2025-01-28-georgi-guninski-uuzcf