5 ms·

There is one problem with those: Security. Using modules (even if they are in the standard library) on the command line lets malicious code in the current dir

• formerly_proven 3y ago
  iirc this is one of the things earmarked for a hypothetical Python 4, making -P the default. It's also one of the many relatively well-known (security) issues in Python that don't get addressed for a surprising amount of time. Others in the same vein would be stuff like stderr being block-buffered when not using a TTY, no randomized hashes for the longest time, loading DLLs preferably from the working directory, std* using 7-bit ASCII in a number of circumstances and many more.
  • TeMPOraL 3y ago
    > loading DLLs preferably from the working directory That is a feature, though, isn't it?
    • formerly_proven 3y ago
      No, the problem was that python[.exe] would load pythonXY.dll etc. from the working directory instead of the installation. Edit: I also recall issues with wheels where .so's in unexpected locations would take preference over the .so files shipped by the wheel. I believe most of that should be fixed nowadays with auditwheel and hardcoded rpaths.
  • jonnycomputer 3y ago
    -P?
    • throwawaymobule 3y ago
      https://docs.python.org/3/using/cmdline.html?highlight=q#cmdoption-P https://docs.python.org/3/using/cmdline.html?highlight=q#cmd... had to look myself. apparantly, it's like setting PYTHONSAFEPATH which prevents 'unsafe' paths from getting added to sys.path. new in 3.11
      • jonnycomputer 3y ago
        New in 3.11; ah; that's why I didn't see the option in my default python.
  • patrec 3y ago
    > stderr being block-buffered As opposed to line buffered, I assume? That sounds annoying, but why is it a security problem? > no randomized hashes I'm not up to date, but I think last I looked, I had the impression that randomized hashes didn't seem like they would fundamentally prevent collision attacks, just require more sophistication. Is that not the case?
• deleted 3y ago
  [deleted]
• cxr 3y ago
  I find the entire premise of the post to be pretty baffling. > Seth pointed out this is useful if you are on Windows and don't have the gzip utility installed. Okay, so instead of installing gzip (or just using the decompressors that aren't the official gzip utility but that do support the format and already ship with Windows by default[1]), you install Python...? Even if the premise weren't muddy from the start, there is a language runtime and ubiquitous cross-platform API already available on all major desktops that has a really good, industrial strength sandbox/containerization strategy that more than adequately mitigates the security issues raised here so you can e.g. rot13 without fear all day to your delight: the browser. 1. <https://news.ycombinator.com/item?id=36099528 https://news.ycombinator.com/item?id=36099528>
  • jerpint 3y ago
    Most people who read this blog already have python installed
    • cxr 3y ago
      The bafflement increases. The topic of this thread is the safety and security of running Python on (or merely next to) arbitrary content. Even ignoring that: is "most people" greater than, less than, or the same amount as "all"?
      • totallywrong 3y ago
        > The bafflement increases. So does the pendantry.
        • cxr 3y ago
          Please don't derail discussions with zero-effort, low-substance nonsequitur oneliners like this.
          • totallywrong 3y ago
            Sorry you're right. But you are being pedantic. These are quick hacks that might come in handy a couple times per year, maybe. Bringing up security, alternative native tools, and even trying to find a formal definition for "most people" is, imo, missing the point.
• jonnycomputer 3y ago
  If running with -m, or -c and an import of package matching name of malicious package. Doesn't happen when running your own script (located in another directory) that imports that package, even if you are running it in that directory.
• johannes1234321 3y ago
  Doing that requires palcement of files right in the directory where the user is likely to run that module. Seems to be a quite rare vector for exploitation. Sure, on a multiuser system I might trick some other user into running such a command in /tmp and prepare that directory accordingly, but other vectors seem more esoteric.
  • mg 3y ago
    There are thousands of tools (shellscripts, makefiles ...) which execute "python -m": https://www.gnod.com/search/?engines=af&nw=1&q=python%20-m https://www.gnod.com/search/?engines=af&nw=1&q=python%20-m Even in Google's own repos. Starting any of those (no matter where they are stored) in a hostile repo would let the code in the repo take over the machine.
    • johannes1234321 3y ago
      If you run anything in a hostile repo, you already lost.