When Arbitrary Code Execution is Working As Intended What Code is Python Supposed To Execute
summary
Python executes code from many surprising places: current directory is often on sys.path, PYTHONPATH/PYTHONHOME/PYTHONSAFE and other env vars change import roots, pth files in site-packages run on startup without import, and pip install or pip download can execute package code. A proof‑of‑concept sandbox called sandbucket prototype uses macOS sandboxing to block access to home secrets while still running pip inside a restricted cache; it mostly works but remains experimental and requires careful vetting.
AI-written summary · about
chapters (16)
- 0:00Introduction to arbitrary code execution
- 2:32Threat modeling and Python's threat model
- 8:29Where Python finds code to execute
- 15:10Securing Python environments from attackers
- 17:14Real-world attack scenarios in Python
- 23:25Why Python's default behavior is dangerous
- 25:32Demo: Sandbucket sandboxing tool
- 28:20Summary and defensive strategies
- 30:07Q&A begins
- 30:35Bundling code as executable for security
- 33:27Practical use of attack vectors
- 35:11Securing open-source projects and users
- 39:05Python-specific vs. general solutions
- 41:51Checksums for interpreter modules
- 44:18Sandboxing on macOS
- 46:45Containers vs. sandbucket for sandboxing
