Skip to main content
edited body
Source Link
schroeder
  • 132.2k
  • 55
  • 307
  • 348

You simply can not assume a program or script is safe solely on theretheir imports. It is to easy to either combine functions or to abuse some 'safe' feature to do something unexpected (like using time queries to transmit data to a command and control server, or tricking the system to running curl with a payload of your data)

The only way to know is to do a proper code review of the script and than evaluate if a script is 'safe' or not (safe being what you define as save to use) there are no High risk imports being added to the script in your post, but you would also have to check for bash / system / eval commands that 'break out' of the python environment

You simply can not assume a program or script is safe solely on there imports. It is to easy to either combine functions or to abuse some 'safe' feature to do something unexpected (like using time queries to transmit data to a command and control server, or tricking the system to running curl with a payload of your data)

The only way to know is to do a proper code review of the script and than evaluate if a script is 'safe' or not (safe being what you define as save to use) there are no High risk imports being added to the script in your post, but you would also have to check for bash / system / eval commands that 'break out' of the python environment

You simply can not assume a program or script is safe solely on their imports. It is to easy to either combine functions or to abuse some 'safe' feature to do something unexpected (like using time queries to transmit data to a command and control server, or tricking the system to running curl with a payload of your data)

The only way to know is to do a proper code review of the script and than evaluate if a script is 'safe' or not (safe being what you define as save to use) there are no High risk imports being added to the script in your post, but you would also have to check for bash / system / eval commands that 'break out' of the python environment

Source Link
LvB
  • 9.1k
  • 1
  • 31
  • 47

You simply can not assume a program or script is safe solely on there imports. It is to easy to either combine functions or to abuse some 'safe' feature to do something unexpected (like using time queries to transmit data to a command and control server, or tricking the system to running curl with a payload of your data)

The only way to know is to do a proper code review of the script and than evaluate if a script is 'safe' or not (safe being what you define as save to use) there are no High risk imports being added to the script in your post, but you would also have to check for bash / system / eval commands that 'break out' of the python environment