3 ms·
Does it matter if the code-execution happens at `pip install` or `python myapp.py`? Using 3rd party libraries inevitably means you're allowing code-execution to
by capableweb 3y ago
Does it matter if the code-execution happens at `pip install` or `python myapp.py`? Using 3rd party libraries inevitably means you're allowing code-execution to 3rd parties, that's the point after all.
- dumbo-octopus 3y agoYes, because you could in theory run `pip install`, then manually read through every file you've just downloaded, then run `python myapp.py`. But every package manager seems to grant RCE to every installed package. I agree it's broken.
- bvrmn 3y ago> then manually read through every file you've just downloaded pip download?
- OrderlyTiamat 3y agoWhich can also execute arbitrary code according to the slides above.
- orlp 3y ago> Yes, because you could in theory run `pip install`, then manually read through every file you've just downloaded, then run `python myapp.py`. This security model is utter nonsense because no one does this.
- arrakeenrevived 3y agoReplace "manually read through every file" with "run your security code scanner against every file" and it becomes less nonsense, but just as applicable. In reality this really isn't how code scans are done, so it's still a little silly, but I could theoretically see something like this being a desire.
- MiguelX413 3y agoIt becomes more applicable, not just as applicable.
- hughesjj 3y agoAmazon asked me to and I actually did it for all the Brazil third party imports... granted it wasn't the most thorough of reviews, as is the nature with huge PRs
- deleted 3y ago[deleted]
- aflag 3y agoYou're not being imaginative enough. Evil Joe: Can you install this package in the system's python install? All users in the lab need it. Naive Joe: Hm... Seems harmless enough enough. Let me just install locally and check if there aren't any setuid binaries in there naivjoe:~ $ pip install --local getpwned ... checks all installed binaries look good ... Naive Joe: Funny package name naivjoe:~ $ sudo pip install getpwned Naive Joe: Done! Evil Joe: Thanks! evil laugh Naive Joe: uh what's so funny? Evil Joe: Nothing. Careless, amateurish? Maybe. Obvious? Maybe not.