On Fri, 19 Jan 2007 10:43:53 -0800, John Zenger wrote:
> Perhaps it is not as severe a security risk, but pure Python programs
> can run into similar problems if they don't check user input for %
> codes.
Please don't top-post.
A: Because it messes up the order that we read things.
Q: Why?
A: Top-posting.
Q: What is the most annoying newsgroup habit?
> Example:
>
>>>> k = raw_input("Try to trick me: ")
> Try to trick me: How about %s this?
>>>> j = "User %s just entered: " + k
>>>> print j % "John"
> Traceback (most recent call last):
> File "<pyshell#8>", line 1, in ?
> print j % "John"
> TypeError: not enough arguments for format string
That's hardly the same sort of vulnerability the article was talking
about, but it is a potential bug waiting to bite.
In a serious application, you should keep user-inputted strings separate
from application strings, and never use user strings unless they've been
made safe. See Joel Spolsky's excellent article about one way of doing
that:
http://www.joelonsoftware.com/articles/Wrong.html
--
Steven.
--
http://mail.python.org/mailman/listinfo/python-list
