Can I tell if a python script is secure from transmitting sensitive data by analyzing its imports?

Question

A thought experiment

My goal is to know whether, and how, a 3rd party python script that may be entrusted with sensitive information, can be trusted on a fundamental level.

Basically this question is, can a Python script communicate with a 3rd party without importing one of a set of core modules to facilitate a communication?

I ask this in the context of reviewing a script that converts a password database. https://github.com/asfaltboy/csv2keepass

And at time of writing, the script only imports:

import argparse
import csv
import datetime
import logging
import operator  # Toolkit
import re
import sys
import xml.etree.ElementTree as ET  # Saves data, easier to type

I do not think there are any dynamic imports in this case; Dynamic imports would sew implicit distrust with me due to complexity.

I know the sys module can touch a couple specific streams.

Given a set of known imports, really a dependency chain; Can it be ruled that a given script is fundamentally incapable of exposing sensitive data? Due to its lack of importing native code to facilitate said transport?

---

Consideration; the open (or file alias) calls are available in all script, since its a core datatype; And due to the flexibility of unix files, should any calls to open/file be considered an attack surface?

Answer 1

You simply can not assume a program or script is safe solely on their imports. It is to easy to either combine functions or to abuse some 'safe' feature to do something unexpected (like using time queries to transmit data to a command and control server, or tricking the system to running curl with a payload of your data)

The only way to know is to do a proper code review of the script and than evaluate if a script is 'safe' or not (safe being what you define as save to use) there are no High risk imports being added to the script in your post, but you would also have to check for bash / system / eval commands that 'break out' of the python environment