4 ms·
There is another category - mistyped commands that are not misspelled. For example, there is a package named “install”. Typing “pip install install” installs i
by Ancapistani 6y ago
There is another category - mistyped commands that are not misspelled.
For example, there is a package named “install”. Typing “pip install install” installs it. If it were malicious, a user might type “pip install “, then copy a complete command from the web that also contains “pip install”. That would result in “pip install pip install <...>}, which effectively prepends “pip” and “install” - both of which are packages - to the list of packages to be installed.
I once tried to claim “requirements.txt” for this reason, but it’s (thankfully, and reasonably) blacklisted. A user mistyping “pip install requirements.txt” (omitting the “-e” flag) would have otherwise installed it. I was planning on writing a small script that alerted the user and offered to install the packages they really wanted if they approved.
- deleted 6y ago[deleted]
- LukeShu 6y ago> (omitting the “-e” flag) You mean "-r"?
- Ancapistani 6y agoProbably. Python is my favorite language by far, but I’ve not worked in it daily for many months.
- shezi 6y ago-r pulls requirements from a file, line by line. -e means editable, it's mostly used for source installs of libraries you want to work on while installed in a project.
- drewp 6y agoMy mnemonic for the "-r" flag is to just remember that k8s gets it right: "kubectl apply -f myfile" ("apply file ...") and pip stacks two verbs together in a silly way: "pip install -r myfile" ("install read ..."??)
- deleted 6y ago[deleted]
- dubbel 6y agoChinese-speaking security researcher fate0 found a way around the blacklisting of requirements.txt in 2017. There is a write-up in English of it here (second half of the chapter): https://haukeluebbers.de/blog/2020-01-timeline-of-package-dependency-compromises/#may---june-2017-evil-cookie-cutters-sighted-more-requirementstxt https://haukeluebbers.de/blog/2020-01-timeline-of-package-de... I agree, it is a different category of attack on the human side of the package manager installation process.