[lnkForumImage]
TotalShareware - Download Free Software
Confronta i prezzi di migliaia di prodotti.
Asp Forum
 Home | Login | Register | Search 


 

Forums >

comp.lang.python

Use eval() safely?

W. Martin Borgert

2/21/2010 9:25:00 PM

Hi,

I know that this issue has been discussed before, but most of
the time using only one argument to eval().

Is it possible to use the following code, e.g. run as part of a
web application, to break in and if so, how?

import math

def myeval(untrustedinput):
return eval(untrustedinput, {"__builtins__": None},
{ "abs": abs, "sin": math.sin })

Is it possible to define functions or import modules from the
untrusted input string?

Which Python built-ins and math functions would I have to add to
the functions dictionary to make it unsafe?

TIA! (Please cc me, thanks.)
6 Answers

Steven D'Aprano

2/21/2010 11:34:00 PM

0

On Sun, 21 Feb 2010 22:25:11 +0100, W. Martin Borgert wrote:

> Hi,
>
> I know that this issue has been discussed before, but most of the time
> using only one argument to eval().
>
> Is it possible to use the following code, e.g. run as part of a web
> application, to break in and if so, how?
>
> import math
>
> def myeval(untrustedinput):
> return eval(untrustedinput, {"__builtins__": None},
> { "abs": abs, "sin": math.sin })
>
> Is it possible to define functions or import modules from the untrusted
> input string?
>
> Which Python built-ins and math functions would I have to add to the
> functions dictionary to make it unsafe?

You've got the right idea, but the task is difficult.

Please read this thread:

http://tav.espians.com/a-challenge-to-break-python-sec...



--
Steven

Gregory Ewing

2/22/2010 5:46:00 AM

0

W. Martin Borgert wrote:

> def myeval(untrustedinput):
> return eval(untrustedinput, {"__builtins__": None},
> { "abs": abs, "sin": math.sin })
>
> Is it possible to define functions or import modules from the
> untrusted input string?

This is NOT safe as it stands. It still isn't safe even if
you put nothing in the globals dict at all.

A couple of ways someone can do nasty things to you:

# Wipe out any file writable by the calling process
eval("[c for c in (0).__class__.__bases__[0].__subclasses__() if c.__name__ ==
'file'][0]('/my/precious/file', 'w')")

# Use up large amounts of memory and CPU time
eval("100000**100000")

--
Greg

Steven D'Aprano

2/22/2010 6:07:00 AM

0

On Mon, 22 Feb 2010 18:45:40 +1300, Gregory Ewing wrote:

> W. Martin Borgert wrote:
>
>> def myeval(untrustedinput):
>> return eval(untrustedinput, {"__builtins__": None},
>> { "abs": abs, "sin": math.sin })
>>
>> Is it possible to define functions or import modules from the untrusted
>> input string?
>
> This is NOT safe as it stands. It still isn't safe even if you put
> nothing in the globals dict at all.

It's *especially* not safe if you put nothing in the globals dict,
because Python kindly rectifies that by putting the builtins into it:

>>> eval("__builtins__.keys()", {}, {})
['IndexError', 'all', 'help', 'vars', ... 'OverflowError']


>>> eval("globals()", {}, {})
{'__builtins__': {...}}
>>>
>>> eval("globals()", {'__builtins__': None}, {})
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "<string>", line 1, in <module>
NameError: name 'globals' is not defined

So {'__builtins__': None} is safer than {}. Still not safe, exactly, but
safer. Or at least you make the Black Hats work harder before they own
your server :)




--
Steven

dieter

2/24/2010 9:11:00 AM

0

Steven D'Aprano <steven@REMOVE.THIS.cybersource.com.au> writes on 22 Feb 2010 06:07:05 GMT:
> ...
> It's *especially* not safe if you put nothing in the globals dict,
> because Python kindly rectifies that by putting the builtins into it:
>
> >>> eval("__builtins__.keys()", {}, {})
> ['IndexError', 'all', 'help', 'vars', ... 'OverflowError']
>
>
> >>> eval("globals()", {}, {})
> {'__builtins__': {...}}
> >>>
> >>> eval("globals()", {'__builtins__': None}, {})
> Traceback (most recent call last):
> File "<stdin>", line 1, in <module>
> File "<string>", line 1, in <module>
> NameError: name 'globals' is not defined
>
> So {'__builtins__': None} is safer than {}. Still not safe, exactly, but
> safer. Or at least you make the Black Hats work harder before they own
> your server :)

Using functionality introduced with the class/type homogenization,
it is quite easy to get access to the "file" type (even when "__builtins__"
is disabled). Having "file", arbitrary files can be read, written, destroyed...


Dieter

Steven D'Aprano

2/25/2010 1:06:00 AM

0

On Wed, 24 Feb 2010 10:11:25 +0100, Dieter Maurer wrote:

> Using functionality introduced with the class/type homogenization, it is
> quite easy to get access to the "file" type (even when "__builtins__" is
> disabled). Having "file", arbitrary files can be read, written,
> destroyed...

Not that I don't believe you (I do!) but could you demonstrate for the
record?



--
Steven

Gregory Ewing

2/25/2010 6:00:00 AM

0

Steven D'Aprano wrote:

> Not that I don't believe you (I do!) but could you demonstrate for the
> record?

I posted a demonstration of this earlier in this thread. The
key thing is the __subclasses__() method of a class. You can
start with any object, work your way up the base class chain
to object, and then use __subclasses__() to get to any builtin
class in the system, including file.

There was a sandboxing scheme put forward a while back which
involves vetting the code and disallowing the use of any
double-underscore attribute names. With a suitably censored
set of builtin functions, this prevents the use of the
__subclasses__ hack, as well as some other potential lines
of attack. As far as I know, nobody managed to break it at
the time, but it probably hasn't been tested much in
the real world, if at all, so I probably wouldn't recommend
using it for anything critical.

--
Greg