Common Python Coding Mistakes
summary
Claims that arbitrary code execution is the most common Python security mistake and demonstrates how using eval on user input allows system commands to run; shows a safe replacement using the ast module to whitelist node types. Reproduces directory traversal and fixes it with realpath/commonprefix checks. Flags outdated libraries like requests <2.20 (HTTPS→HTTP redirect leaks Authorization), shows GitHub CodeQL and Dependabot automation, notes assert disabled with -O and that broken access control rises to OWASP #1 (94% tested). AppDynamics RASP is presented as a runtime mitigation.
AI-written summary · about
chapters (5)
- 0:00Start
- 11:18Arbitrary Code Execution
- 21:47Directory Traversal Attack
- 30:23Outdated Libraries
- 48:14Broken Access Control
related talks
26mTesting Python Security
25mUnexpected Execution: Wild Ways Code Execution can Occur in Python
45mPython common security mistakes in 2022
01h 24mCode Red: Navigating the Minefield of Security Programming Blunders
25m"Security considerations in Python Packaging"
54mPython Security Best Practices Against Vulnerabilities
50mWhen Arbitrary Code Execution is Working As Intended What Code is Python Supposed To Execute
53mBuilding secure web apps: Python vs the OWASP Top 10