|  | eval() == evil? --- How to use it safely? | | |
| | | Fett |  |
|  Posted: Thu Aug 28, 2008 9:51 pm Post subject: eval() == evil? --- How to use it safely? |  |
| |  | |
I am creating a program that requires some data that must be kept up
to date. What I plan is to put this data up on a web-site then have
the program periodically pull the data off the web-site.
My problem is that when I pull the data (currently stored as a
dictionary on the site) off the site, it is a string, I can use eval()
to make that string into a dictionary, and everything is great.
However, this means that I am using eval() on some string on a web-
site, which seems pretty un-safe.
I read that by using eval(code,{"__builtins__":None},{}) I can prevent
them from using pretty much anything, and my nested dictionary of
strings is still allowable. What I want to know is:
What are the dangers of eval?
- I originally was using exec() but switched to eval() because I
didn't want some hacker to be able to delete/steal files off my
clients computers. I assume this is not an issue with eval(), since
eval wont execute commands.
- What exactly can someone do by modifying my code string in a command
like: thing = eval(code{"__builtins__":None},{}), anything other than
assign their own values to the object thing? |
| |
| | | Bruno Desthuilliers | |
| | Posted: Thu Aug 28, 2008 9:51 pm Post subject: Re: eval() == evil? --- How to use it safely? | |
Fett a écrit :
| Quote: | I am creating a program that requires some data that must be kept up
to date. What I plan is to put this data up on a web-site then have
the program periodically pull the data off the web-site.
My problem is that when I pull the data (currently stored as a
dictionary on the site) off the site, it is a string, I can use eval()
|
Short answer: use json as the format for data transfer. |
| |
| | | Jean-Paul Calderone | |
| | Posted: Thu Aug 28, 2008 9:51 pm Post subject: Re: eval() == evil? --- How to use it safely? | |
| | | |
On Thu, 28 Aug 2008 14:51:57 -0700 (PDT), Fett <fettmanchu@gmail.com> wrote:
| Quote: | I am creating a program that requires some data that must be kept up
to date. What I plan is to put this data up on a web-site then have
the program periodically pull the data off the web-site.
My problem is that when I pull the data (currently stored as a
dictionary on the site) off the site, it is a string, I can use eval()
to make that string into a dictionary, and everything is great.
However, this means that I am using eval() on some string on a web-
site, which seems pretty un-safe.
I read that by using eval(code,{"__builtins__":None},{}) I can prevent
them from using pretty much anything, and my nested dictionary of
strings is still allowable. What I want to know is:
What are the dangers of eval?
- I originally was using exec() but switched to eval() because I
didn't want some hacker to be able to delete/steal files off my
clients computers. I assume this is not an issue with eval(), since
eval wont execute commands.
- What exactly can someone do by modifying my code string in a command
like: thing = eval(code{"__builtins__":None},{}), anything other than
assign their own values to the object thing?
|
eval and exec are the same. Don't use either with strings from a web page.
Try using a simple format for you data, such as CSV.
Jean-Paul |
| |
| | | Guilherme Polo | |
| | Posted: Thu Aug 28, 2008 9:51 pm Post subject: Re: eval() == evil? --- How to use it safely? | |
| | | |
On Thu, Aug 28, 2008 at 6:51 PM, Fett <FettManChu@gmail.com> wrote:
| Quote: | I am creating a program that requires some data that must be kept up
to date. What I plan is to put this data up on a web-site then have
the program periodically pull the data off the web-site.
My problem is that when I pull the data (currently stored as a
dictionary on the site) off the site, it is a string, I can use eval()
to make that string into a dictionary, and everything is great.
However, this means that I am using eval() on some string on a web-
site, which seems pretty un-safe.
I read that by using eval(code,{"__builtins__":None},{}) I can prevent
them from using pretty much anything, and my nested dictionary of
strings is still allowable. What I want to know is:
What are the dangers of eval?
- I originally was using exec() but switched to eval() because I
didn't want some hacker to be able to delete/steal files off my
clients computers. I assume this is not an issue with eval(), since
eval wont execute commands.
- What exactly can someone do by modifying my code string in a command
like: thing = eval(code{"__builtins__":None},{}), anything other than
assign their own values to the object thing?
|
By "disabling" __builtins__ you indeed cut some obvious tricks, but
someone still could send you a string like "10 ** 10 ** 10".
--
-- Guilherme H. Polo Goncalves |
| |
| | | James Mills | |
| | Posted: Thu Aug 28, 2008 9:51 pm Post subject: Re: eval() == evil? --- How to use it safely? | |
| | | |
Hi,
If you cannot use a simple data structure/format
like JSON, or CSV, or similar, _don't_
use eval or exec, but use the pickle
libraries instead. This is much safer.
cheers
James
On Fri, Aug 29, 2008 at 7:51 AM, Fett <FettManChu@gmail.com> wrote:
| Quote: | I am creating a program that requires some data that must be kept up
to date. What I plan is to put this data up on a web-site then have
the program periodically pull the data off the web-site.
My problem is that when I pull the data (currently stored as a
dictionary on the site) off the site, it is a string, I can use eval()
to make that string into a dictionary, and everything is great.
However, this means that I am using eval() on some string on a web-
site, which seems pretty un-safe.
I read that by using eval(code,{"__builtins__":None},{}) I can prevent
them from using pretty much anything, and my nested dictionary of
strings is still allowable. What I want to know is:
What are the dangers of eval?
- I originally was using exec() but switched to eval() because I
didn't want some hacker to be able to delete/steal files off my
clients computers. I assume this is not an issue with eval(), since
eval wont execute commands.
- What exactly can someone do by modifying my code string in a command
like: thing = eval(code{"__builtins__":None},{}), anything other than
assign their own values to the object thing?
--
LINK
|
--
--
-- "Problems are solved by method" |
| |
| | | Steven D'Aprano | |
| | Posted: Thu Aug 28, 2008 10:12 pm Post subject: Re: eval() == evil? --- How to use it safely? | |
| | | |
On Thu, 28 Aug 2008 14:51:57 -0700, Fett wrote:
| Quote: | I read that by using eval(code,{"__builtins__":None},{}) I can prevent
them from using pretty much anything,
|
No, it can prevent them from some obvious dangers, but not all obvious
dangers and possibly not unobvious ones.
| Quote: | and my nested dictionary of
strings is still allowable. What I want to know is:
What are the dangers of eval?
|
You're executing code on your server that was written by arbitrary and
untrusted people over the Internet.
| Quote: | - I originally was using exec() but switched to eval() because I didn't
want some hacker to be able to delete/steal files off my clients
computers. I assume this is not an issue with eval(), since eval wont
execute commands.
|
Bare eval() certainly can:
eval('__import__("os").system("ls *")') # or worse...
eval() with the extra arguments given makes that sort of thing harder,
but does it make it impossible? Are you willing to bet your server on it?
| Quote: | - What exactly can someone do by modifying my code string in a command
like: thing = eval(code{"__builtins__":None},{}), anything other than
assign their own values to the object thing?
|
They can cause an exception:
code = '0.0/0.0'
thing = eval(code, {"__builtins__": None}, {})
They can cause a denial of service attack:
code = '10**10**10'
They can feed you bad data:
code = "{ 'akey': 'Something You Don\'t Expect' }"
You have to deal with bad data no matter what you do, but why make it
easy for them to cause exceptions?
BTW, in case you think that you only have to deal with malicious attacks,
you also have to deal with accidents caused by incompetent users.
--
Steven |
| |
| | | Paul Rubin | |
| | Posted: Thu Aug 28, 2008 10:57 pm Post subject: Re: eval() == evil? --- How to use it safely? | |
Fett <FettManChu@gmail.com> writes:
| Quote: | However, this means that I am using eval() on some string on a web-
site, which seems pretty un-safe.
|
Don't even think of doing that.
| Quote: | I read that by using eval(code,{"__builtins__":None},{})
|
It is not reliable enough. Don't use eval for this AT ALL.
| Quote: | - I originally was using exec() but switched to eval()
|
For this purpose there is no difference between exec and eval.
Use something like simpleson or cjson instead. |
| |
| | | Paul Rubin | |
| | Posted: Thu Aug 28, 2008 10:57 pm Post subject: Re: eval() == evil? --- How to use it safely? | |
"James Mills" <prologic@shortcircuit.net.au> writes:
| Quote: | If you cannot use a simple data structure/format
like JSON, or CSV, or similar, _don't_
use eval or exec, but use the pickle
libraries instead. This is much safer.
|
Pickle uses eval and should also be considered unsafe, as its
documentation describes. |
| |
| | | castironpi | |
| | Posted: Thu Aug 28, 2008 11:42 pm Post subject: Re: eval() == evil? --- How to use it safely? | |
On Aug 28, 4:51 pm, Fett <FettMan...@gmail.com> wrote:
| Quote: | I am creating a program that requires some data that must be kept up
to date. What I plan is to put this data up on a web-site then have
the program periodically pull the data off the web-site.
My problem is that when I pull the data (currently stored as a
dictionary on the site) off the site, it is a string, I can use eval()
to make that string into a dictionary, and everything is great.
However, this means that I am using eval() on some string on a web-
site, which seems pretty un-safe.
|
May I suggest PyYAML? |
| |
| | | Matimus | |
| | Posted: Thu Aug 28, 2008 11:56 pm Post subject: Re: eval() == evil? --- How to use it safely? | |
| | | |
On Aug 28, 3:09 pm, "Guilherme Polo" <ggp...@gmail.com> wrote:
| Quote: | On Thu, Aug 28, 2008 at 6:51 PM, Fett <FettMan...@gmail.com> wrote:
I am creating a program that requires some data that must be kept up
to date. What I plan is to put this data up on a web-site then have
the program periodically pull the data off the web-site.
My problem is that when I pull the data (currently stored as a
dictionary on the site) off the site, it is a string, I can use eval()
to make that string into a dictionary, and everything is great.
However, this means that I am using eval() on some string on a web-
site, which seems pretty un-safe.
I read that by using eval(code,{"__builtins__":None},{}) I can prevent
them from using pretty much anything, and my nested dictionary of
strings is still allowable. What I want to know is:
What are the dangers of eval?
- I originally was using exec() but switched to eval() because I
didn't want some hacker to be able to delete/steal files off my
clients computers. I assume this is not an issue with eval(), since
eval wont execute commands.
- What exactly can someone do by modifying my code string in a command
like: thing = eval(code{"__builtins__":None},{}), anything other than
assign their own values to the object thing?
By "disabling" __builtins__ you indeed cut some obvious tricks, but
someone still could send you a string like "10 ** 10 ** 10".
--
LINK
--
-- Guilherme H. Polo Goncalves
|
Or, they could pass in something like this:
(t for t in 42 .__class__.__base__.__subclasses__() if t.__name__ ='LibraryLoader').next()((t for t in
__class__.__base__.__subclasses__() if t.__name__ ='CDLL').next()).msvcrt.system("SOMETHING MALICIOUS")
Which can be used to execute pretty much anything on a Windows system
using a "safe" eval. This same exploit exists in some form on *nix.
The above assumes that ctypes has been loaded. It can be modified to
call code in other modules that have been loaded though as well.
Matt |
| |
| Page 1 of 2 .:. Goto page 1, 2 Next | |
|
|
