Securing Code with the Python Type System
summary
Uses concrete defenses: a new PEP 675 literal string type rejects unsafe f‑strings for SQL, simple runtime type validation auto‑rejects malformed JSON payloads, and a taint tracker (Pysa) plus a type checker finds cross‑function leaks. Measurements claim that tools of this style surface >50% of vulnerabilities at scale. Examples show exact API signatures, library hooks, and deployment points (IDE, CI) and report tradeoffs: false positives, slower CI runs, and the need for broad type coverage.
AI-written summary · about
chapters (14)
- 0:00Introduction to speaker
- 0:54Shifting security left
- 2:59Types for security
- 4:04SQL injection prevention
- 6:51Static analysis limitations
- 9:15Literal string type
- 12:10Continuous type detection
- 12:50Path traversal attacks
- 15:22Runtime type validation
- 17:14Data flow analysis
- 19:15Using Pysa for security
- 22:02Importance of type coverage
- 25:44Adding types to projects
- 26:56Conclusion and roadmap
related talks
27mStatic Code Analysis with Python
28mTypes, Deeper Static Analysis, and you
24mStatic type-checking is dead, long live static type-checking in Python!
26mTesting Python Security
34mSecure Python Development: Tips, Tricks, and Tools
41mEcosystem for Reliable Python Programming
31mStatic Type Analysis for Robust Data Products
51mTaking Python beyond scripting