Re: "Rehabilitating Pickle" a talk at PyCon UK 2018

--0000000000000af3df05805dd7b3
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

My application is a GUI app that uses ZODB Filestorage files as it's
storage format and these files can be sent to other people who expect to be
able to open them without risk of their machine getting taken over. Makes
sense?

I think I solved the problem by overriding classFactory() in ZODB.DB.DB:

class XoverDB(DB):
    """
    derived from ZODB.DB.DB - overrides classFactory() to only allow
    import of very specific classes
    """
    def classFactory(self, connection, modulename, globalname):
        if (modulename, globalname) not in ALLOWED_MODULE_GLOBALS:
            raise TypeError("Not allowed to import global %r from
module %r" % (globalname, modulename))
        return super().classFactory(connection, modulename, globalname)

ALLOWED_MODULE_GLOBALS is a lsit of (modulename, globalname) tuples.

Did I miss anything?

Best regards,
J=C3=BCrgen Herrmann

Am Do., 24. Jan. 2019 um 20:31 Uhr schrieb Sean Upton <[email protected]>:

>
> On Jan 24, 2019, at 11:09 AM, 'Juergen Herrmann' via zodb <
> [email protected]> wrote:
>
> I use the ZODB as file format for a application that is used by end users=
.
> So telling them "don't open files from untrusted sources" seems a bit wei=
rd
> :)
>
>
> Your ZEO isn't open to the public on a TCP port, only your application on
> machines you control, no?  That makes the "injection" security question a=
n
> application concern, not a ZODB or pickle problem?
>
> If you open your ZEO (or RelStorage) to Python applications running on
> machines you don't control, you are doing something ZODB was not designed
> to directly address.
>
> Sean
>

--=20
You received this message because you are subscribed to the Google Groups "=
zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].
For more options, visit https://groups.google.com/d/optout.

--0000000000000af3df05805dd7b3
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">My application is a GUI app that uses ZOD=
B Filestorage files as it&#39;s storage format and these files can be sent =
to other people who expect to be able to open them without risk of their ma=
chine getting taken over. Makes sense?<div><br></div><div>I think I solved =
the problem by overriding classFactory() in ZODB.DB.DB:</div><div><pre styl=
e=3D"background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:&quo=
t;DejaVu Sans Mono&quot;"><span style=3D"color:rgb(204,120,50)">class </spa=
n>XoverDB(DB):<br>    <span style=3D"color:rgb(98,151,85);font-style:italic=
">&quot;&quot;&quot;<br></span><span style=3D"color:rgb(98,151,85);font-sty=
le:italic">    derived from ZODB.DB.DB - overrides classFactory() to only a=
llow<br></span><span style=3D"color:rgb(98,151,85);font-style:italic">    i=
mport of very specific classes<br></span><span style=3D"color:rgb(98,151,85=
);font-style:italic">    &quot;&quot;&quot;<br></span><span style=3D"color:=
rgb(98,151,85);font-style:italic">    </span><span style=3D"color:rgb(204,1=
20,50)">def </span><span style=3D"color:rgb(255,198,109)">classFactory</spa=
n>(<span style=3D"color:rgb(148,85,141)">self</span><span style=3D"color:rg=
b(204,120,50)">, </span>connection<span style=3D"color:rgb(204,120,50)">, <=
/span>modulename<span style=3D"color:rgb(204,120,50)">, </span>globalname):=
<br>        <span style=3D"color:rgb(204,120,50)">if </span>(modulename<spa=
n style=3D"color:rgb(204,120,50)">, </span>globalname) <span style=3D"color=
:rgb(204,120,50)">not in </span>ALLOWED_MODULE_GLOBALS:<br>            <spa=
n style=3D"color:rgb(204,120,50)">raise </span><span style=3D"color:rgb(136=
,136,198)">TypeError</span>(<span style=3D"color:rgb(106,135,89)">&quot;Not=
 allowed to import global %r from module %r&quot; </span>% (globalname<span=
 style=3D"color:rgb(204,120,50)">, </span>modulename))<br>        <span sty=
le=3D"color:rgb(204,120,50)">return </span><span style=3D"color:rgb(136,136=
,198)">super</span>().classFactory(connection<span style=3D"color:rgb(204,1=
20,50)">, </span>modulename<span style=3D"color:rgb(204,120,50)">, </span>g=
lobalname)<br></pre></div></div><div>ALLOWED_MODULE_GLOBALS is a lsit of (m=
odulename, globalname) tuples.</div><div><br></div><div>Did I miss anything=
?</div><div><br></div><div>Best regards,</div><div>J=C3=BCrgen Herrmann</di=
v><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">Am D=
o., 24. Jan. 2019 um 20:31=C2=A0Uhr schrieb Sean Upton &lt;<a href=3D"mailt=
o:[email protected]">[email protected]</a>&gt;:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><div style=3D"overflow-wrap: break-word;">=
<br><div><blockquote type=3D"cite"><div>On Jan 24, 2019, at 11:09 AM, &#39;=
Juergen Herrmann&#39; via zodb &lt;<a href=3D"mailto:[email protected]"=
 target=3D"_blank">[email protected]</a>&gt; wrote:</div><br class=3D"g=
mail-m_8650428089494660211Apple-interchange-newline"><div><span style=3D"fo=
nt-family:Helvetica;font-size:12px;font-style:normal;font-variant-caps:norm=
al;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0p=
x;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:n=
one;float:none;display:inline">I use the ZODB as file format for a applicat=
ion that is used by end users. So telling them &quot;don&#39;t open files f=
rom untrusted sources&quot; seems a bit weird :)</span><br class=3D"gmail-m=
_8650428089494660211Apple-interchange-newline"></div></blockquote></div><br=
><div>Your ZEO isn&#39;t open to the public on a TCP port, only your applic=
ation on machines you control, no?=C2=A0 That makes the &quot;injection&quo=
t; security question an application concern, not a ZODB or pickle problem?<=
/div><div><br></div><div>If you open your ZEO (or RelStorage) to Python app=
lications running on machines you don&#39;t control, you are doing somethin=
g ZODB was not designed to directly address.</div><div><br></div><div>Sean<=
/div></div></blockquote></div></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;zodb&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">zodb+unsubscri=
[email protected]</a>.<br />
For more options, visit <a href=3D"https://groups.google.com/d/optout">http=
s://groups.google.com/d/optout</a>.<br />

--0000000000000af3df05805dd7b3--