Looking at the Python documentation can be dangerous

https://twitter.com/marekgibney/status/1598706464583028736

by mg • 4 years ago

2 5 4 years ago

eesmith3• 4 years ago

No need for "-m". Just starting Python in an untrusted directory can be a problem.

  % echo "print('Ha-ha.')" > inspect.py
  % python
  ....
  Type "help", "copyright", "credits" or "license" for more information.
  Ha-ha.
  >>>

mg2• 4 years ago

Yes, I think every use of "python" without a filename is dangerous because it will make python look in the current dir for imports.

The tricky thing is that the python call might be somewhere in a shellscript you use. The issue came up when an irc user reported his computer goes bananas when he cds into a certain dir. Turned out he had his shell set up so that it executes some Python onevery cd. In that dir, there was a "types.py". And the shellscript ran some Python that imported "types".

eesmith3• 4 years ago

Huh. Looks like there's a solution in 3.11: https://docs.python.org/3/using/cmdline.html#cmdoption-P

  -P

    Don’t prepend a potentially unsafe path to sys.path:
     * python -m module command line: Don’t prepend the current working directory.

     * python script.py command line: Don’t prepend the script’s directory.
        If it’s a symbolic link, resolve symbolic links.

     * python -c code and python (REPL) command lines: Don’t prepend an empty
        string, which means the current working directory.

    See also the PYTHONSAFEPATH environment variable, and -E and -I (isolated) options.

    New in version 3.11.

Or perhaps '-I'? https://docs.python.org/3/using/cmdline.html#cmdoption-I

    Run Python in isolated mode. This also implies -E, -P and -s options.

    In isolated mode sys.path contains neither the script’s directory nor
    the user’s site-packages directory. All PYTHON* environment variables
    are ignored, too. Further restrictions may be imposed to prevent the
    user from injecting malicious code.

    New in version 3.4.

Looking at the Python documentation can be dangerous

Related Stories