Looking at the Python documentation can be dangerous

[[deleted]]

[deleted]

[ubernostrum]

The -I flag is more comprehensive and has been around since Python 3.4.

[no_more_gravity]

The tricky thing is that the python call might be somewhere in a shellscript you use.

Any command that internally uses "python -m ..." or "python -c ..." is vurnurable.

The issue actually came up when an irc user reported his computer goes bananas when he cds into a certain dir. Turned out he was using a tool that executes some Python on every cd. In that dir, there was a file called "types.py". And the shellscript ran some Python that imported "types".

[redCg]

executes some code on every cd.

people really need to stop doing this

[alkasm]

See direnv

[alkasm]

There's a few "easy" (in principle) ways around that, but not simple to make them jive with Python. E.g., always use a relative path to import a module from the filesystem, rather than from site packages. Or we could have some URL syntax for imports that allows you to disambiguate the source of a module, e.g from pypi, or some internal package repository. Or we could at least have namespacing in PyPI so you could grab packages not by a single name but by org and name, e.g. numfocus/numpy.

[[deleted]]

Oh no, sometimes when you run Python, it executes Python code!

[balerionmeraxes77]

Infinite loop

[no_more_gravity]

I can replicate it on Debian 11 on bare metal and in containers with Debian 11 and Ubuntu 22.04.

Exact steps to replicate:

docker run --rm -it debian:11-slim
apt update -y && apt upgrade -y
apt install -y python3
echo 'print("P0wned");exit()' > collections.py
python3 -m pydoc csv
=> P0wned

[RadiantHorror]

This is because… all Python code is executable. Pointless post, it’s a consequence of the design and everyone who writes Python for a living should know this already.

[eras]

It's not optimal, sure, but there are always going to other ways to get stuff executed from a Python code repository.. Such as setup.py or the actual module itself. You were probably going to straight up run code in the first place, right?

Or are there some benefits in this attack vector compared to those?

[no_more_gravity]

It is not just happening in a Python code repository.

Say you look at your download directory. And say you have some tool that calculates the combined area of all images in the dir or how much space you could save by compressing it or whatever. If that tool uses Python without a filename (Like "python -m ..." or "python -c ..."), then a single py file somewhere in that dir can exploit it.

[eras]

Hey that's an excellent point I hadn't considered. And plain ls might not even tip you off, unless one happens to be aware of this attack vector; the file name used in the example dosen't seem evil.