Re: RE: Advise of programming one of my first programs

References	(3 earlier) <5B80DD153D7D744689F57F4FB69AF4740928E137@SCACMX008.exchad.jpmchase.net> <4F72385E.8020804@cs.wisc.edu> <CABicbJKMdxbQ-r2Qmxy2n8W2YpxNAXos9WLKuz7rrhLz8KF+ow@mail.gmail.com> <5B80DD153D7D744689F57F4FB69AF4740929109C@SCACMX008.exchad.jpmchase.net> <CAKhY55MCtxnafbz+aPsAMndtcNruU0ZQcoP_FPC=9mwRncrbyA@mail.gmail.com>
Date	2012-03-29 11:07 +1100
Subject	Re: RE: Advise of programming one of my first programs
From	Chris Angelico <rosuav@gmail.com>
Newsgroups	comp.lang.python
Message-ID	<mailman.1103.1332979676.3037.python-list@python.org> (permalink)

Show all headers | View raw

 Thu, Mar 29, 2012 at 9:36 AM, Anatoli Hristov <tolidtm@gmail.com> wrote:
>> > > Um, at least by my understanding, the use of Pickle is also dangerous
>> > > if you are not completely sure what is being passed in:
>> >
>> > Oh goodness yes. pickle is exactly as unsafe as eval is. Try running
>> > this code:
>> >
>> > from pickle import loads
>> > loads("c__builtin__\neval\n(c__builtin__\nraw_input\n(S'py>'\ntRtR.")
>>
>> It might be as dangerous, but which is more likely to cause problems in
>> real world scenarios?
>
> Guys this is really something  that is not that important at this time for
> me

Maybe not, but it's still worth being aware of. Even if today your
strings will never include apostrophes, it's still important to
understand the risks of SQL injection and properly escape them before
inserting them into an SQL statement. Just docket the information in
the back of your mind "Don't use pickle with untrusted data" and move
on. :)

ChrisA

Back to comp.lang.python | Previous | Next | Find similar | Unroll thread

Thread

Re: RE: Advise of programming one of my first programs Chris Angelico <rosuav@gmail.com> - 2012-03-29 11:07 +1100

csiph-web