Re: "Rehabilitating Pickle" a talk at PyCon UK 2018
Jim Fulton <[email protected]> Sat, 26 Jan 2019 11:00:23 -0700
| Newsgroups | gmane.comp.web.zope.zodb |
|---|---|
| Message-ID | <CAPDm-FgG-CXq6KxYz9zWviOkPXkCu2Cv4RERiy47VWrsj-JtnA@mail.gmail.com> |
--000000000000627ed00580603875 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sat, Jan 26, 2019 at 8:10 AM 'Juergen Herrmann' via zodb < [email protected]> wrote: > My application is a GUI app that uses ZODB Filestorage files as it's > storage format and these files can be sent to other people who expect to = be > able to open them without risk of their machine getting taken over. Makes > sense? > Yup. Interesting. > > I think I solved the problem by overriding classFactory() in ZODB.DB.DB: > > class XoverDB(DB): > """ > derived from ZODB.DB.DB - overrides classFactory() to only allow > import of very specific classes > """ > def classFactory(self, connection, modulename, globalname): > if (modulename, globalname) not in ALLOWED_MODULE_GLOBALS: > raise TypeError("Not allowed to import global %r from module = %r" % (globalname, modulename)) > return super().classFactory(connection, modulename, globalname) > > ALLOWED_MODULE_GLOBALS is a lsit of (modulename, globalname) tuples. > > Did I miss anything? > That seems reasonable to me. If you're feeling especially paranoid, perhaps you want some data validation logic in your application's __setstate__ methods (which you're probably not defining now) to protect against some of the other attacks mentioned in the subject video. There are lots of schema libraries around that might help. Jim > > Best regards, > J=C3=BCrgen Herrmann > > Am Do., 24. Jan. 2019 um 20:31 Uhr schrieb Sean Upton <[email protected]>= : > >> >> On Jan 24, 2019, at 11:09 AM, 'Juergen Herrmann' via zodb < >> [email protected]> wrote: >> >> I use the ZODB as file format for a application that is used by end >> users. So telling them "don't open files from untrusted sources" seems a >> bit weird :) >> >> >> Your ZEO isn't open to the public on a TCP port, only your application o= n >> machines you control, no? That makes the "injection" security question = an >> application concern, not a ZODB or pickle problem? >> >> If you open your ZEO (or RelStorage) to Python applications running on >> machines you don't control, you are doing something ZODB was not designe= d >> to directly address. >> >> Sean >> > -- > You received this message because you are subscribed to the Google Groups > "zodb" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > --=20 Jim Fulton http://jimfulton.info --=20 You received this message because you are subscribed to the Google Groups "= zodb" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to [email protected]. For more options, visit https://groups.google.com/d/optout. --000000000000627ed00580603875 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div dir=3D"ltr"><br></div><div class=3D"gmail_quote"><div= dir=3D"ltr" class=3D"gmail_attr">On Sat, Jan 26, 2019 at 8:10 AM 'Juer= gen Herrmann' via zodb <<a href=3D"mailto:[email protected]">zod= [email protected]</a>> wrote:<br></div><blockquote class=3D"gmail_quote= " style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);= padding-left:1ex"><div dir=3D"ltr"><div dir=3D"ltr">My application is a GUI= app that uses ZODB Filestorage files as it's storage format and these = files can be sent to other people who expect to be able to open them withou= t risk of their machine getting taken over. Makes sense?</div></div></block= quote><div><br></div><div>Yup. Interesting.</div><div>=C2=A0</div><blockquo= te class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px = solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div dir=3D"ltr">= <div><br></div><div>I think I solved the problem by overriding classFactory= () in ZODB.DB.DB:</div><div><pre style=3D"background-color:rgb(43,43,43);co= lor:rgb(169,183,198);font-family:"DejaVu Sans Mono""><span style= =3D"color:rgb(204,120,50)">class </span>XoverDB(DB):<br> <span style=3D"= color:rgb(98,151,85);font-style:italic">"""<br></span><span = style=3D"color:rgb(98,151,85);font-style:italic"> derived from ZODB.DB.D= B - overrides classFactory() to only allow<br></span><span style=3D"color:r= gb(98,151,85);font-style:italic"> import of very specific classes<br></s= pan><span style=3D"color:rgb(98,151,85);font-style:italic"> ""= "<br></span><span style=3D"color:rgb(98,151,85);font-style:italic"> = </span><span style=3D"color:rgb(204,120,50)">def </span><span style=3D"col= or:rgb(255,198,109)">classFactory</span>(<span style=3D"color:rgb(148,85,14= 1)">self</span><span style=3D"color:rgb(204,120,50)">, </span>connection<sp= an style=3D"color:rgb(204,120,50)">, </span>modulename<span style=3D"color:= rgb(204,120,50)">, </span>globalname):<br> <span style=3D"color:rgb(= 204,120,50)">if </span>(modulename<span style=3D"color:rgb(204,120,50)">, <= /span>globalname) <span style=3D"color:rgb(204,120,50)">not in </span>ALLOW= ED_MODULE_GLOBALS:<br> <span style=3D"color:rgb(204,120,50)">rai= se </span><span style=3D"color:rgb(136,136,198)">TypeError</span>(<span sty= le=3D"color:rgb(106,135,89)">"Not allowed to import global %r from mod= ule %r" </span>% (globalname<span style=3D"color:rgb(204,120,50)">, </= span>modulename))<br> <span style=3D"color:rgb(204,120,50)">return <= /span><span style=3D"color:rgb(136,136,198)">super</span>().classFactory(co= nnection<span style=3D"color:rgb(204,120,50)">, </span>modulename<span styl= e=3D"color:rgb(204,120,50)">, </span>globalname)<br></pre></div></div><div>= ALLOWED_MODULE_GLOBALS is a lsit of (modulename, globalname) tuples.</div><= div><br></div><div>Did I miss anything?</div></div></blockquote><div><br></= div><div>That seems reasonable to me.=C2=A0 If you're feeling especiall= y paranoid, perhaps you want some data validation logic in your application= 's __setstate__ methods (which you're probably not defining now) to= protect against some of the other attacks mentioned in the subject video.= =C2=A0 There are lots of schema libraries around that might help.</div><div= ><br></div><div>Jim</div><div>=C2=A0</div><blockquote class=3D"gmail_quote"= style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);p= adding-left:1ex"><div dir=3D"ltr"><div><br></div><div>Best regards,</div><d= iv>J=C3=BCrgen Herrmann</div><br><div class=3D"gmail_quote"><div dir=3D"ltr= " class=3D"gmail-m_-7972025574924423171gmail_attr">Am Do., 24. Jan. 2019 um= 20:31=C2=A0Uhr schrieb Sean Upton <<a href=3D"mailto:[email protected]"= target=3D"_blank">[email protected]</a>>:<br></div><blockquote class=3D= "gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(2= 04,204,204);padding-left:1ex"><div><br><div><blockquote type=3D"cite"><div>= On Jan 24, 2019, at 11:09 AM, 'Juergen Herrmann' via zodb <<a hr= ef=3D"mailto:[email protected]" target=3D"_blank">[email protected]= </a>> wrote:</div><br class=3D"gmail-m_-7972025574924423171gmail-m_86504= 28089494660211Apple-interchange-newline"><div><span style=3D"font-family:He= lvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-weig= ht:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-trans= form:none;white-space:normal;word-spacing:0px;text-decoration:none;float:no= ne;display:inline">I use the ZODB as file format for a application that is = used by end users. So telling them "don't open files from untruste= d sources" seems a bit weird :)</span><br class=3D"gmail-m_-7972025574= 924423171gmail-m_8650428089494660211Apple-interchange-newline"></div></bloc= kquote></div><br><div>Your ZEO isn't open to the public on a TCP port, = only your application on machines you control, no?=C2=A0 That makes the &qu= ot;injection" security question an application concern, not a ZODB or = pickle problem?</div><div><br></div><div>If you open your ZEO (or RelStorag= e) to Python applications running on machines you don't control, you ar= e doing something ZODB was not designed to directly address.</div><div><br>= </div><div>Sean</div></div></blockquote></div></div> <p></p> -- <br> You received this message because you are subscribed to the Google Groups &= quot;zodb" group.<br> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:[email protected]" target=3D"_bla= nk">[email protected]</a>.<br> For more options, visit <a href=3D"https://groups.google.com/d/optout" targ= et=3D"_blank">https://groups.google.com/d/optout</a>.<br> </blockquote></div><br clear=3D"all"><div><br></div>-- <br><div dir=3D"ltr"= class=3D"gmail_signature">Jim Fulton<br><a href=3D"http://jimfulton.info" = target=3D"_blank">http://jimfulton.info</a><br></div></div> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;zodb" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:[email protected]">zodb+unsubscri= [email protected]</a>.<br /> For more options, visit <a href=3D"https://groups.google.com/d/optout">http= s://groups.google.com/d/optout</a>.<br /> --000000000000627ed00580603875--