Timeline for Does blocking keywords prevent code injection inside this interactive Python file?
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 17, 2021 at 18:56 | comment | added | Nick Bonilla |
@NotThatGuy vars(__builtins__)['ev'+'al']("print('pwned')") (credit for this comment goes to a modified version of security.stackexchange.com/a/246169/240562 where he used 'exec' instead of 'eval')
|
|
| Mar 17, 2021 at 14:18 | comment | added | NotThatGuy |
You could generate additional Python code (into say a string), but the typical way to execute generated code would be using eval or by writing a file and then executing it with OS commands. How would you execute the code without eval or any imports?
|
|
| Mar 16, 2021 at 20:31 | comment | added | amon | However, deciding whether a given Python fragment is “safe” is an undecidable problem (for any interesting definition of safety). The usual syntax-driven approaches could be used to allow a tiny safe subset of the language though. Due to these constraints, methods that audit security-sensitive behaviour at runtime are more popular, e.g. running a process with untrusted code under a restrictive seccomp profile. | |
| Mar 16, 2021 at 19:51 | history | edited | Nick Bonilla | CC BY-SA 4.0 |
added 117 characters in body
|
| Mar 16, 2021 at 19:45 | history | answered | Nick Bonilla | CC BY-SA 4.0 |