Questions tagged [python]

High-level dynamic language developed by Guido van Rossum, particularly popular for server-side web programming and scripting.

Originally released in 1991, Python is a multi-paradigm programming language. Object-oriented programming and structured programming are fully supported, and many of its features support functional programming and aspect-oriented programming.

An important goal of Python's developers is keeping it fun to use. This is reflected in the language's name—a tribute to the British comedy group Monty Python—and in occasionally playful approaches to tutorials and reference materials, such as examples that refer to spam and eggs (from a famous Monty Python sketch) instead of the standard foo and bar.

Most Python implementations (including CPython) include a read–eval–print loop (REPL), permitting them to function as a command line interpreter for which the user enters statements sequentially and receives results immediately.

The language's core philosophy is summarized in the document The Zen of Python (PEP 20), which includes aphorisms such as:

  • Explicit is better than implicit
  • Simple is better than complex
  • Complex is better than complicated
  • Readability counts

Questions with this tag should relate to or include the Python programming language.

Sources:

423 questions
123
votes
3 answers

Does bcrypt have a maximum password length?

I was messing around with bcrypt today and noticed something: hashpw('testtdsdddddddddddddddddddddddddddddddddddddddddddddddsddddddddddddddddd', salt) Output: '$2a$15$jQYbLa5m0PIo7eZ6MGCzr.BC17WEAHyTHiwv8oLvyYcg3guP5Zc1y'…
d0ctor
  • 1,333
  • 2
  • 9
  • 7
45
votes
1 answer

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

So, due to bad programming on the part of one of my former colleagues, one of our internal web apps allows the user to upload and run an arbitrary Python file. This recently came to light via an anonymous tip. So far I haven't done anything too…
ian93
  • 481
  • 1
  • 5
  • 6
40
votes
3 answers

Unable to understand why the web app is vulnerable to a Directory traversal attack

I was working with this web-app, when someone pen-tested it and sent me a huge report that says my app is vulnerable to a Directory traversal attack. Here is one sample: Testing Path: http://127.0.0.1:80/??/etc/issue <- VULNERABLE! I put…
Batman
  • 835
  • 1
  • 8
  • 14
30
votes
1 answer

Django SECRET_KEY security, how are methods more secure

I am nearing a point where I will deploy my Django application to the hostile environment otherwise known as "the internet" and I'm trying to better understand the ramifications of the Django SECRET_KEY . One of the standard procedures it seems is…
James
  • 555
  • 2
  • 5
  • 8
23
votes
6 answers

Is it important for an ethical hacker to know the C language in-depth nowadays?

I'm interested in becoming an ethical hacker someday. I've been reading articles saying the Python language is very popular in hacking activity because of the extent of its modules (including network). Nowadays, lots of applications are web…
Cronos
  • 233
  • 1
  • 2
  • 5
20
votes
6 answers

Do high level languages allow for buffer / heap overflow?

I'm learning about basic x86 overflows in C but normally I code with Python. Is there anyway that programs written in higher level languages can suffer from buffer/heap overflow?
blank
  • 235
  • 1
  • 2
  • 3
19
votes
2 answers

Are python's popen (and similar) functions affected by Shellshock?

Basically which python's functions trigger bash (and might be impacted by shellshock), and which don't ? I have come up with this question by seeing in some scripts the popen() function. My question relates to both Python 2 and 3.
Grzegorz Wierzowiecki
  • 667
  • 1
  • 6
  • 18
17
votes
4 answers

Are there any Security Concerns to using Python F Strings with User Input

Background A while ago I started using F strings in Python but remembered seeing some security concerns with using them with user input so I have made a point of not using them for those situations. Question Are there security concerns to using…
MikeSchem
  • 2,411
  • 2
  • 18
  • 38
15
votes
3 answers

Does python's pip provide cryptographic authentication and integrity validation?

Does python's pip package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing installation instructions with steps asking…
Michael Altfield
  • 1,319
  • 11
  • 27
13
votes
4 answers

What are the pros and cons of using sha256 to hash a password before passing it to bcrypt?

I recently became aware of the fact that bcrypt truncates passwords to 72 characters. Practically speaking my intuition is that this does not pose any major security problems. However, I understand that it does mean any software libraries that use…
Dan Tao
  • 291
  • 2
  • 6
13
votes
3 answers

Filter arbitrary code for blacklisted keywords except on commented lines

I have a Rust-app executing Python-scripts using PyO3. The Python-scripts are uploaded by users, so I need to check for unsafe code before executing it. The scripts should only be able to do mathematical operations and in no case should access…
O'Niel
  • 3,530
  • 3
  • 24
  • 36
13
votes
1 answer

Python's http.server library "basic security checks"

According to: https://docs.python.org/3/library/http.server.html Warning http.server is not recommended for production. It only implements basic security checks. It doesn't state what security vulnerabilities the server is exposed to. I'm a sysadmin…
user227415
  • 131
  • 1
  • 3
12
votes
3 answers

Safely load a pickle file?

In our Python app, we are using pickle.load to load a file named perceptron.pkl . A HP Fortify static scan raises a high vulnerability, "Dynamic Code Evaluation - Unsafe Pickle Deserialization", at the same line. How can I remediate this? Is there…
Pro
  • 261
  • 1
  • 3
  • 4
12
votes
1 answer

Is it safe to use Python package managers like pip, easy_install or conda?

I know it is unsafe to install software (including Python packages) from not trusted or compromised sources. However I wonder how safe I am when I am installing a trusted package from Python Package Index or from Anaconda repository (which I also…
abukaj
  • 293
  • 2
  • 8
11
votes
2 answers

MongoDB Nosql injection in python code

Here is the code snippet for accessing to MongoDB. client = MongoClient() db = client.test_database collection = db.test # Get data from fields condition = form.getvalue('name') if condition: where = {"$where": "this.name == '"+condition+"'" } else:…
Yang Yu
  • 449
  • 3
  • 5
  • 13
1
2 3
…
28 29