We recently had issues with people messing around inside our system. To prevent code injections within my python code, I implemented the following
#! /usr/bin/python3 #-*- coding:utf-8 -*- def main(): print("Your interactive Python shell!") text = input('>>> ') for keyword in ['eval', 'exec', 'import', 'open', 'os', 'read', 'system', 'write']: if keyword in text: print("You are not allowed to do this!") return; else: exec(text) print('Executed your code!') if __name__ == "__main__": main()
A few (user) people can run this python file with sudo rights inside our Ubuntu system. I know this sounds like a security hole, but I don't see any possibility to escape from this. Is there any possibility to inject inside my code block? Do you have any tips to prevent code injections?