Timeline for Are there any Security Concerns to using Python F Strings with User Input
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 19 at 7:12 | answer | added | socrates | timeline score: 1 | |
| S May 13, 2021 at 17:48 | vote | accept | MikeSchem | ||
| May 12, 2021 at 18:33 | vote | accept | MikeSchem | ||
| S May 13, 2021 at 17:48 | |||||
| May 11, 2021 at 8:31 | answer | added | Al Bundy | timeline score: 0 | |
| Oct 17, 2020 at 21:00 | history | tweeted | twitter.com/StackSecurity/status/1317571120724381697 | ||
| Oct 17, 2020 at 11:22 | answer | added | Arminius | timeline score: 22 | |
| Oct 17, 2020 at 1:08 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Sep 17, 2020 at 0:23 | answer | added | multithr3at3d | timeline score: 4 | |
| Sep 15, 2020 at 18:57 | comment | added | MikeSchem |
ok, so I'm aware of that, but that would be the same with any user input method. Since the F string is computed at runtime, I'm wondering if you can force it to eval a statement like if I passed in 1+1. I did try that and it just interprets it as a string so no problem there.
|
|
| Sep 15, 2020 at 18:31 | comment | added | Conor Mancone |
It depends entirely on what you do with it. Your new string contains user input so if, for example, you pass it off to os.system you now have RCE.
|
|
| Sep 15, 2020 at 16:36 | history | asked | MikeSchem | CC BY-SA 4.0 |