Deutsch English Français Italiano |
<mailman.19.1725057954.2917.python-list@python.org> View for Bookmarking (what is this?) Look up another Usenet article |
Path: ...!3.eu.feeder.erje.net!feeder.erje.net!fu-berlin.de!uni-berlin.de!not-for-mail From: Thomas Passin <list1@tompassin.net> Newsgroups: comp.lang.python Subject: Re: Sanitise user input for a script Date: Fri, 30 Aug 2024 18:35:59 -0400 Lines: 31 Message-ID: <mailman.19.1725057954.2917.python-list@python.org> References: <Y_Bag-4OjGfIUUu5xJIzjMhKnizgNZcYAf05yMBQT7n_j-eeooAwDo2e1yVK1FWLbhUeQLmRZ82ywJcyqs13yuDBuejH_fHBxwNHDBRm_1A=@protonmail.com> <69cb2985-3284-426d-a8b0-af256a3ac2ff@tompassin.net> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: news.uni-berlin.de uAJqEKvYiATlJKxnl67zjwGY/eZTfAQKJo7BbG1QSBIw== Cancel-Lock: sha1:SSiZjMNzhYrWE5CZuhttHC3u9Og= sha256:UHD+y96CTbKzmur1AgjcSZVG0cQnvoAtbDQWO1//zi4= Return-Path: <list1@tompassin.net> X-Original-To: python-list@python.org Delivered-To: python-list@mail.python.org Authentication-Results: mail.python.org; dkim=pass reason="2048-bit key; unprotected key" header.d=tompassin.net header.i=@tompassin.net header.b=j7jw+YTL; dkim-adsp=pass; dkim-atps=neutral X-Spam-Status: OK 0.018 X-Spam-Evidence: '*H*': 0.96; '*S*': 0.00; 'received:23.83.212': 0.09; 'received:elm.relay.mailchannels.net': 0.09; 'subject:script': 0.09; 'then.': 0.09; 'holzer': 0.16; 'instead.': 0.16; 'machine.': 0.16; 'protecting': 0.16; 'received:10.0.0': 0.16; 'received:64.90': 0.16; 'received:64.90.62': 0.16; 'received:64.90.62.162': 0.16; 'received:dreamhost.com': 0.16; 'script,': 0.16; 'simon': 0.16; 'things,': 0.16; 'wrote:': 0.16; 'python': 0.16; 'api': 0.17; "aren't": 0.19; 'it?': 0.19; 'pm,': 0.19; 'to:addr:python-list': 0.20; 'input': 0.21; "i'd": 0.24; 'practices': 0.26; 'creating': 0.27; 'expect': 0.28; 'thinking': 0.28; 'suggestions': 0.28; 'header:User-Agent:1': 0.30; 'python- list': 0.32; 'received:10.0': 0.32; 'received:mailchannels.net': 0.32; 'received:relay.mailchannels.net': 0.32; 'but': 0.32; "i'm": 0.33; 'subject:for': 0.33; 'script': 0.33; 'server': 0.33; 'windows': 0.34; 'someone': 0.34; 'same': 0.34; 'header:In-Reply- To:1': 0.34; 'using': 0.37; 'way': 0.38; 'could': 0.38; 'read': 0.38; 'use': 0.39; 'should': 0.40; 'best': 0.61; 'method': 0.61; 'limited': 0.62; 'follow': 0.62; 'send': 0.63; 'between': 0.63; 'your': 0.64; 'let': 0.66; 'forget': 0.67; 'header:Received:6': 0.67; 'received:64': 0.67; 'know.': 0.68; 'malicious': 0.69; 'protection': 0.70; 'offer': 0.71; 'itself.': 0.84 X-Sender-Id: dreamhost|x-authsender|tpassin@tompassin.net ARC-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1725057360; a=rsa-sha256; cv=none; b=4PWVGHyrmniGTRE8WFDkHnB3nRkhq5y3ZlXljQpvcqKkMWlreqF0Sq8ko4k9QoNZL0YmoT yRRXK1nRhM0fRqD9QdUAs6e5c3ZFVzkhuvaDv4Q/He7rU3xK7+qGP/yRIebRQevReUe0HI jo9TB/ohesCe5zs7mLOjWpjU5dB3b70LGklXzgFPJO8Ylz54Et0VCSoP+OyPMBv3KfE7n4 VLxArIxgeubcaKDpsimlv82A8FykAcqeiFKvV70KM5COX10AHsA6PGcDP/Vwbr9tJm2pzW w7gp0JAb1YxaMapnP4dlXHYV2V7AO+sfj4CIAwij0OwibFzE4HjS1Gaksr4Q2g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1725057360; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=7szXevUS86swd94kPBbiL2sqHdWG2jbylXnSjLcGNlE=; b=KQd14v2zFiqgVd7+0nRstnByf+CRKdpqPuHYqHvqRwCTT1Ey+ozHcbqBgXC0C0AiQT2lXL hjf/JCvilMQQiRoP3DDHlZsdOtrTCkbd4ZEfR8vmrumoMF0UXf3Yu7cvRqwJXHel0lJNxu bvB8R9o2D13QDZcclQ3R2+GOnQFy1s05B2GJjQwUJ+fC+gp4PqPrNTa/2M8sPJmRiqROBP 0mSYY9cnlEGzsCnWbjmQiiCeSHFtbPflPAoA2/eGl/ktx2orMc7oW9QY6pDxq1wT+MZiV6 H3qlN5OtGz5RsfWhHXEX6IwlE9RE8NkhgBXt6V2jlJlYRNdgiQhBAX9vnIeMIg== ARC-Authentication-Results: i=1; rspamd-6b9c67f469-ts4df; auth=pass smtp.auth=dreamhost smtp.mailfrom=list1@tompassin.net X-Sender-Id: dreamhost|x-authsender|tpassin@tompassin.net X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|tpassin@tompassin.net X-MailChannels-Auth-Id: dreamhost X-Battle-Industry: 39a331566574bf5d_1725057360881_1525512543 X-MC-Loop-Signature: 1725057360881:2145966563 X-MC-Ingress-Time: 1725057360880 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tompassin.net; s=dreamhost; t=1725057360; bh=7szXevUS86swd94kPBbiL2sqHdWG2jbylXnSjLcGNlE=; h=Date:Subject:To:From:Content-Type:Content-Transfer-Encoding; b=j7jw+YTLYTGEo3BVi8NHeJPwnb1Ca6KgUgclGbYkq0uXi6kP4vMGc+gis4j341Ptk oc2kXYxWwjpXj5bDXyyAxsAFDKyRvTLa9y0wkpW2a/P1YOseOkO10htl2GMFB21aAW jl0DrXmpCQqX60z+QTB9atdmyyUPHibfvGlC5bpEo1qxq+XNSog8XzGntsvx88QMzM 6d1nsQhMas36opY+QzpYVe/UffrOUbvLbLswR5Jcmoob4Yq1E76y3xVJnSekvYTi/S FEU4tZBy2rIdLmOTsOtC5pBsgm6+VLPss86e1MzqNR+Ej6cXVEOSU3WFjdvXgG8GkR k58HkqR0Fu/Gw== User-Agent: Mozilla Thunderbird Content-Language: en-US In-Reply-To: <Y_Bag-4OjGfIUUu5xJIzjMhKnizgNZcYAf05yMBQT7n_j-eeooAwDo2e1yVK1FWLbhUeQLmRZ82ywJcyqs13yuDBuejH_fHBxwNHDBRm_1A=@protonmail.com> X-BeenThere: python-list@python.org X-Mailman-Version: 2.1.39 Precedence: list List-Id: General discussion list for the Python programming language <python-list.python.org> List-Unsubscribe: <https://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe> List-Archive: <https://mail.python.org/pipermail/python-list/> List-Post: <mailto:python-list@python.org> List-Help: <mailto:python-list-request@python.org?subject=help> List-Subscribe: <https://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe> X-Mailman-Original-Message-ID: <69cb2985-3284-426d-a8b0-af256a3ac2ff@tompassin.net> X-Mailman-Original-References: <Y_Bag-4OjGfIUUu5xJIzjMhKnizgNZcYAf05yMBQT7n_j-eeooAwDo2e1yVK1FWLbhUeQLmRZ82ywJcyqs13yuDBuejH_fHBxwNHDBRm_1A=@protonmail.com> Bytes: 7368 On 8/30/2024 3:18 PM, Simon Connah via Python-list wrote: > I need to write a script that will take some user input (supplied on a website) and then execute a Python script on a host via SSH. I'm curious what the best options are for protecting against malicious input in much the smae way as you sanitise SQL to protect against SQL injections. You should never, never, never "sanitize" SQL. Use prepared statements instead. What kind of user input do you expect to get that would need to be "sanitized"? How are you going to use it such that malicious input might cause trouble? I hope you aren't planning to exec() it. Are you expecting a user to send in a script and your server will execute it? Better read up on sandboxing, then. If you won't be exec()ing a script, then you can consider creating an API where each method of the API can only do limited things, and only with certain parameters not all of all them. The SSH message can include the name of the method to use. And follow what Peter Holzer wrote. Don't forget that quoting practices are not the same between Windows and Linux. > I could do it either on the website itself or by doing it on the host machine. > > I'm thinking of using argparse but I'm aware it does not offer any protection itself. > > If someone has any suggestions I'd appreciated it. If you need more information then please let me know. > > Simon. > >