gabegoodhart

3 ms·

1. 1.▲
   by gabegoodhart 4y ago

   Yep, this is spot on. As written, import_tracker does indeed do a dynamic import of the library in question and you're right that this introduces the possibility of arbitrary code execution. Currently, import_tracker is designed for li
2. 2.▲
   by gabegoodhart 4y ago

   Makes sense! I think the commenter below correctly addressed the true security concern here which is importing arbitrary python libraries. As is, import_tracker doesn't attempt to solve this problem (though it's an interesting one
3. 3.▲
   by gabegoodhart 4y ago

   Hi, I'm the main author of import_tracker. Thanks for taking the time to dig into it! It's a really interesting point that the subproces.Popen could itself be a security concern. The command that's being executed is executing