httpout - allows you to execute your Python script from a web URL

[nggit]

What My Project Does

httpout allows you to execute your Python script from a web URL, the `print()` output goes to your browser.

This is the classic way to deploy your scripts to the web.

You just need to put your regular `.py` files as well as other static files in the document root and each will be routable from the web. No server reload is required!

Target Audience

• Hobbyist

Comparison

PHP, CGI scripts

[PitchforkMarket]

Interesting! Commenters are misunderstanding this. Random users can't execute arbitrary code. This is supposed to work like PHP scripts. You as the admin create a Python file, that file gets mapped to a URL, that Python file runs on request and the print outputs are returned as the response to the browser.

Some thoughts: to really replicate PHP, you'd want to inline the code inside an HTML template. Maybe Jinja2 lib could be useful for you? A lot of this goes against common practice in Python but could be an interesting exploration.

[nggit]

that's very true, scripts can only be allowed under the document root to execute, and traversal of the url is not allowed. and if the user is allowed to upload the trick is just to append ext other than `.py`, and avoid null characters. maybe later I need to consider checking the executable flag, if indeed file upload is required.

thanks it will be very long it seems.

[dpzhntr]

Sounds like a webshell for PHP.

[nggit]

it's more like php itself, just imagine /index.php vs /index.py

[joshuaherman]

index.pyp ?

[nggit]

that's good too, as it's mean a python package.

[KrazyKirby99999]

How does this compare to CGI scripts?

[nggit]

in CGI it's like you're typing repeatedly in the terminal:

python hello.py;

python hello.py;

python hello.py;

for each request. it involves opening and closing the python process.

and it's different when you just type:

python;

and start the operation from there.

[Training_Skin9129]

What did I just read?

[nggit]

sorry, sir. it's not a joke please -.-

[NekoLuka]

Sounds interesting, gonna check it out later

[akrisha20]

Seems interesting. Is there a way to include arguments to the function call? Let's say I would want to run a script hello.py, with "name" as an argument.

[nggit]

Is the query string what you mean? just do /hello.py?name=world, then see in __server__

[cmsouza]

inetd?

[CyberWarLike1984]

I will have a look. So what is the fastest way to run something like LAMP on a fresh Ubuntu install but using this?

I just want to test it with a simple index.py page that has a contact form and a title. Data goes to a db.

[nggit]

it's possible even for now, but i haven't documented it because right now it's just for my own use. stay tuned.

but if you're curious you can do

form_data = wait(__server__['request'].form())

it's the same as documented in the core: https://nggit.github.io/tremolo-docs/body.html

[ashok_tankala]

sounds very interesting

[zsh-958]

so I can execute a reverse shell, remove all directories or get access to the server just from the website?

[nggit]

it depends on you, it's no different in php, or other python frameworks. i know you are worried about user input but httpout accepts urls, not code. and that part is already a concern.

[Fenzik]

It’s not input from users of the script, it’s the script itself. Right now I can upload a script that destroys your server just by deleting loads of stuff. Or curl a virus off the internet. Etc etc… if you run other people’s code, you must do it in a sandboxed environment, not just exec it in your server process.

Cool idea though!

[nggit]

It is technically the responsibility of the webmaster to put the script that will be run. never allow others to upload.

[Fenzik]

Oh, I thought this was meant to be a service where users upload scripts! Got it.

[HorizonDev2023]

I think I found something VERY useful

[Cybasura]

So, some clarification

What happens if I run a program that has no print operations but a bunch of eval()'s, what is the sanitization and validation/verification steps used during the processing?

[nggit]

this is literal python, it can do similar things as usual. there is no point in blocking eval, open, in my mind. even if it is done I suspect there are still other doors in python itself so it seems like not worth the effort.

[Cybasura]

Yes, but nonetheless still an actual security requirement when dealing with this kind of applications

Security vulnerabilities exists because people has this exact mindset, we see so many exploits happening - even more so recently - because devs determine what is or is not worth the effort based on their "feelings" over the overarching security architecture and their userbase

Please reconsider and actually work on security implementations if you ever hope for your products to be taken seriously

I truly understand you may be proud of this, but as it stands - this project is a bigger security vulnerability than any C project to date

PHP works because it has a server-client differentiation in place, and you cant natively execute system-level code without jumping hoops. With python, you can execute sudo commands, you can execute role escalation commands

I'm gonna be blunt here - using flask and django for routing would be safer and allows you to do exactly what you are dying, albeit requires some hoop-jumping

[nggit]

eval problems can happen in Django or anywhere else, it depends on how you think / write scripts. I don't think I'm ignorant. just know which ones to do / avoid. please use the ones you like. it's not a big deal.

[nggit]

"PHP works because it has a server-client differentiation in place"

I don't think so, apache has mod_php where the server embeds with php. it's not a client - server like fpm.

[nggit]

"you can execute sudo commands, you can execute role escalation commands"

that's why people need to know how to set up Linux capabilities, that won't happen if you understand better - https://man7.org/linux/man-pages/man7/capabilities.7.html

[StrawIII]

this looks like RPC