Testing Python Security
summary
Examples include concrete exploits: eval/exec and subprocess misuse lets attacker-import modules and run shell commands; pickle enables arbitrary code execution when loading untrusted data; simple string-built SQL queries lead to injection and remote command execution. Countermeasures shown are input whitelists, disabling builtins, sandboxing, using parameterized SQL and safer APIs, and automated scanning with Bandit plugin scanning which flags vulnerable string formatting and risky module use. Several demos reproduce exploits and mitigations reliably.
AI-written summary · about
chapters (7)
- 0:00Start
- 5:04No globals
- 6:29Refuse access to the builtins
- 17:17Automatic Scanning tools
- 22:09CPython vulnerabilities
- 22:58Insecure packages
- 23:49Code optimization
related talks
25mUnexpected Execution: Wild Ways Code Execution can Occur in Python
59mCommon Python Coding Mistakes
54mPython Security Best Practices Against Vulnerabilities
45mPython common security mistakes in 2022
34mSecure Python Development: Tips, Tricks, and Tools
25m"Security considerations in Python Packaging"
35mSecuring Python projects Supply Chain
28mUnveiling Remote Code Execution: How Vulnerabilities Lead to System Takeovers