DEV Community

Discussion on: Open Source Adventures: Episode 58: PyScript: First Impressions

View post
Collapse
 
wiseai profile image
Mahmoud Harmouch • • Edited

The other day, I was tinkering around that library hunting for security vulns, turns out that the majority of os methods are blocked by default. So, I was attempting the following:

with open("/lib/python3.10/hacky_module.py", "wt") as f:
    f.write("import os;command = "ls -la";print(os.system(command))")

import hacky_module
Enter fullscreen mode Exit fullscreen mode

Which gives the following output:

-1
Enter fullscreen mode Exit fullscreen mode

Meaning that an error was thrown. However, you can run the following:

import os
print(os.listdir('/'))
Enter fullscreen mode Exit fullscreen mode

which returns:

['tmp', 'home', 'dev', 'proc', 'lib']
Enter fullscreen mode Exit fullscreen mode

Same for the subprocess module:

import subprocess
command = "ls -la"

list_dirs = subprocess.run(["bash", "-c", command],
    stdout=subprocess.PIPE, stderr=subprocess.PIPE,
    check=True,
    text=True)

print(list_dirs.stdout)
Enter fullscreen mode Exit fullscreen mode

Which throws an error when executing it.

So, the framework is pretty secure. Other than the race condition, the only downside is being ridiculously slow. I am not sure whether or not it is a problem tied to the framework or the language itself: python. Most likely the latter. I will be investigating this over the weekend.

Collapse
 
taw profile image
Tomasz Wegrzanowski •

It runs in WASM so any vulnerabilities you'd get would be browser vulnerabilities, right?
There's probably some fake emulated "file system", wasm running in the browser has no access to platform files.