A thought experiment
My goal is to know whether, and how, a 3rd party python script that may be entrusted with sensitive information, can be trusted on a fundamental level.
Basically this question is, can a Python script communicate with a 3rd party without importing one of a set of core modules to facilitate a communication?
I ask this in the context of reviewing a script that converts a password database. https://github.com/asfaltboy/csv2keepass
And at time of writing, the script only imports:
import argparse import csv import datetime import logging import operator # Toolkit import re import sys import xml.etree.ElementTree as ET # Saves data, easier to type
I do not think there are any dynamic imports in this case; Dynamic imports would sew implicit distrust with me due to complexity.
I know the sys module can touch a couple specific streams.
Given a set of known imports, really a dependency chain; Can it be ruled that a given script is fundamentally incapable of exposing sensitive data? Due to its lack of importing native code to facilitate said transport?
file alias) calls are available in all script, since its a core datatype; And due to the flexibility of unix files, should any calls to open/file be considered an attack surface?