Re:Python Malware Starting to Employ Anti-Debug Techniques
by baeaz on Friday December 23, 2022 @08:42AM
(#34105672)
That makes me think - would it be possible to have a runtime or build time option for cpython that removes eval() ?
[ Parent
| on HN ]
Re:Python Malware Starting to Employ Anti-Debug Techniques
by bb88 on Friday December 23, 2022 @08:47AM
(#34105728)
Probably. But python missed their chance to nix it with the 2->3 transition.
My favorite case was when a newbie coder used eval() to evaluate something that looked json-ish, which, came from an api request.
Re:Python Malware Starting to Employ Anti-Debug Techniques
by dtgriscom on Friday December 23, 2022 @09:18AM
(#34106033)
Simple and powerful. Gotta love it (until your customer doesn't, big-time).
Re:Python Malware Starting to Employ Anti-Debug Techniques
by theptip on Friday December 23, 2022 @01:38PM
(#34109179)
If you run a security linter like ‘bandit’ you’ll get warnings for eval and other security holes.
It seems you can’t run bandit on deps, but perhaps if you fork them and build yourself?
If you are security conscious, having a rule that you can only install from a local pypi with packages you have forked would be a more defensible perimeter. But, a maintenance pain for sure.