Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.python > #86937
| Path | csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!feeds.phibee-telecom.net!newsfeed.xs4all.nl!newsfeed1.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail |
|---|---|
| Return-Path | <ian.g.kelly@gmail.com> |
| X-Original-To | python-list@python.org |
| Delivered-To | python-list@mail.python.org |
| X-Spam-Status | OK 0.031 |
| X-Spam-Evidence | '*H*': 0.94; '*S*': 0.00; 'subject:not': 0.03; 'default.': 0.09; 'exec': 0.09; 'reached.': 0.09; 'finney': 0.16; 'fork': 0.16; 'subject:run': 0.16; 'unsafe': 0.16; 'wrote:': 0.18; 'replacing': 0.19; 'thu,': 0.19; '>>>': 0.22; 'memory': 0.22; 'import': 0.22; 'second': 0.26; 'header:In-Reply-To:1': 0.27; 'am,': 0.29; 'message-id:@mail.gmail.com': 0.30; 'code': 0.31; '>>>>': 0.31; 'writes:': 0.31; 'know.': 0.32; 'run': 0.32; 'point.': 0.35; 'received:google.com': 0.35; 'so,': 0.37; 'ben': 0.38; 'to:addr:python-list': 0.38; 'to:addr:python.org': 0.39; 'dave': 0.60; "you'll": 0.62; 'mar': 0.68; 'limit': 0.70; 'subject:this': 0.83; '2015': 0.84; 'calls,': 0.84; 'race': 0.95 |
| DKIM-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type:content-transfer-encoding; bh=MaNVyX1O5kpXC2LNZd3gioAexCVD4/RNtSlw2CVGWhQ=; b=G/x5bg2HSKML5YhWyLpSteGSf6xpdGytKohMywFmFvcuabNB8qqeybHrp7Xg7PDpB/ SQEMRDAeTpPgfM3rHuI/x13V0H72fGhRosrI6M3at64TN0Ev8Cd/Zuc6LKu4wf6mI1Qx K1jYp1Uhc0qoY0UU8BbhH5HNj1uy3j7P0fhDmpuxtwQVS9NG80VZ7/nBD+qLwyo4mysy oUQUhwmcDU4BEYWR0yPRCdyFJy+d670cyCTkk7hRju/tqALmuLmESIfZzHkDmNusdUwb S18Hu7pvl9RwU1nJezBZJqhqskypOcrxd+SjhYJfUfoNOpPgMcmv6DqYpfnNLEIZbqIK 8JrA== |
| X-Received | by 10.70.54.103 with SMTP id i7mr13797149pdp.114.1425542399560; Wed, 04 Mar 2015 23:59:59 -0800 (PST) |
| MIME-Version | 1.0 |
| In-Reply-To | <gi1gfalrm71kqju9qcmcgus5pbseit2eqo@4ax.com> |
| References | <CAPTjJmoSgX6_HO16b2WB=vT+y8tys0ZyvcD-XVS+=6hj=gtUTQ@mail.gmail.com> <mailman.56.1425537863.21433.python-list@python.org> <gi1gfalrm71kqju9qcmcgus5pbseit2eqo@4ax.com> |
| From | Ian Kelly <ian.g.kelly@gmail.com> |
| Date | Thu, 5 Mar 2015 00:59:19 -0700 |
| Subject | Re: Do not run this code. |
| To | Python <python-list@python.org> |
| Content-Type | text/plain; charset=UTF-8 |
| Content-Transfer-Encoding | quoted-printable |
| X-BeenThere | python-list@python.org |
| X-Mailman-Version | 2.1.19 |
| Precedence | list |
| List-Id | General discussion list for the Python programming language <python-list.python.org> |
| List-Unsubscribe | <https://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe> |
| List-Archive | <http://mail.python.org/pipermail/python-list/> |
| List-Post | <mailto:python-list@python.org> |
| List-Help | <mailto:python-list-request@python.org?subject=help> |
| List-Subscribe | <https://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe> |
| Newsgroups | comp.lang.python |
| Message-ID | <mailman.58.1425542402.21433.python-list@python.org> (permalink) |
| Lines | 30 |
| NNTP-Posting-Host | 2001:888:2000:d::a6 |
| X-Trace | 1425542402 news.xs4all.nl 2971 [2001:888:2000:d::a6]:51826 |
| X-Complaints-To | abuse@xs4all.nl |
| Xref | csiph.com comp.lang.python:86937 |
Show key headers only | View raw
On Thu, Mar 5, 2015 at 12:39 AM, Dave Farrance <DaveFarrance@omitthisyahooandthis.co.uk> wrote: > Ben Finney <ben+python@benfinney.id.au> wrote: > >>Chris Angelico <rosuav@gmail.com> writes: >> >>> import base64; exec(…) >> >>That's all I need to know. Code with ‘exec()’ calls, I consider unsafe >>by default. > > Indeed. replacing exec with print... > >>>> print(base64.b64decode(b"eD0neD0lcjsgZXhlYyh4JSV4KSc7IGV4ZWMoeCV4KQ==")) > x='x=%r; exec(x%%x)'; exec(x%x) > > so, discarding that second exec... > >>>> x='x=%r; exec(x%%x)' >>>> print(x) > x=%r; exec(x%%x) > > So it recurses, and if that second exec had been left in then it would be > a fork bomb. In order to be a fork bomb, it would have to call fork at some point. This is just a race to see whether you'll run out of memory before the recursion limit is reached.
Back to comp.lang.python | Previous | Next — Previous in thread | Find similar | Unroll thread
Re: Do not run this code. Ben Finney <ben+python@benfinney.id.au> - 2015-03-05 17:44 +1100
Re: Do not run this code. Dave Farrance <DaveFarrance@OMiTTHiSyahooANDTHiS.co.uk> - 2015-03-05 07:39 +0000
Re: Do not run this code. Ian Kelly <ian.g.kelly@gmail.com> - 2015-03-05 00:59 -0700
csiph-web