4 ms·
MyPy requests permission to write data to the hard drive. MyPy writes malicious payload to a file and then execs it. MyPy never wrote a damn thing to a socket,
by JackRabbitSlim 7y ago
MyPy requests permission to write data to the hard drive. MyPy writes malicious payload to a file and then execs it. MyPy never wrote a damn thing to a socket, netcat did through a bash/ash shell. (Windows named pipes may be a little trickier to work with but can yield similar results)
Sandboxing libraries specifically seems like a fools errand.
- tus88 7y agoWriting to HDD would be considered a suspicious permission for most modules. Like opening network socket or patching another module's namespace. I don't know exactly how it would work. Maybe modules that request these permissions get extra scrutiny, or users can specify "levels" that different modules can run at. If you specify MyPy to run at the least-priv level, it will fail to install/load if it requests greater capabilities. I can't really think of any other way around the problem. It is a problem for all other scripting languages, especially nodeJS.