Common security gotchas in Python and how to avoid them
hackernoon.com
hackernoon.com
> Because of the variable latency involved in most web-applications, it’s pretty much impossible to write a timing attack over HTTP web servers.
There are certainly demonstrated timing attacks against webapps, it may take a little extra time for the attacker, but latency won't save you here, you should always use constant time comparison, there's little excuse not to.
If we pickle a string which comes from an untrusted source, that’s fine right? There’s no way to format the string or anything such that it exploits any kind of vulnerability with pickle. Right?
I don’t see any way this could be possible - in order to create a malicious pickle object you’d have to have your untrusted input somehow “break outside” of its string container before it even gets pickled.
But honestly, what’s the use-case for pickle that can’t be replaced with a safer string-based format like JSON?
- you need to serialise arbitrary objects - you both read and write only using Python - your transfer protocol handles binary data (as opposed to plain text) - you don't need the serialisation to be human-readable - you want to be able to handle any Python type - you don't want to write your own serialization rules
JSON is "safer" only if you have full control over deserialization.