Re: "Rehabilitating Pickle" a talk at PyCon UK 2018
"'Juergen Herrmann' via zodb" <[email protected]> Sun, 27 Jan 2019 21:37:45 +0100
| Newsgroups | gmane.comp.web.zope.zodb |
|---|---|
| Message-ID | <CANFWCWi43pm4Nk7ZV6j2_0pNorS79B2Oy+qeBQpgqLgMeDPb8g@mail.gmail.com> |
--000000000000f7408c0580768889 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Am Sa., 26. Jan. 2019 um 19:00 Uhr schrieb Jim Fulton <[email protected]>: > > On Sat, Jan 26, 2019 at 8:10 AM 'Juergen Herrmann' via zodb < > [email protected]> wrote: > >> My application is a GUI app that uses ZODB Filestorage files as it's >> storage format and these files can be sent to other people who expect to= be >> able to open them without risk of their machine getting taken over. Make= s >> sense? >> > > Yup. Interesting. > In case anybody is interesed i pasted a stripped down version of my FileStorage wrapper class here: https://pastebin.com/VvXJY3vP I found the whole process of working with the ZODB as application file format simply wonderful and very straightforward! > > >> >> I think I solved the problem by overriding classFactory() in ZODB.DB.DB: >> >> class XoverDB(DB): >> """ >> derived from ZODB.DB.DB - overrides classFactory() to only allow >> import of very specific classes >> """ >> def classFactory(self, connection, modulename, globalname): >> if (modulename, globalname) not in ALLOWED_MODULE_GLOBALS: >> raise TypeError("Not allowed to import global %r from module= %r" % (globalname, modulename)) >> return super().classFactory(connection, modulename, globalname) >> >> ALLOWED_MODULE_GLOBALS is a lsit of (modulename, globalname) tuples. >> >> Did I miss anything? >> > > That seems reasonable to me. If you're feeling especially paranoid, > perhaps you want some data validation logic in your application's > __setstate__ methods (which you're probably not defining now) to protect > against some of the other attacks mentioned in the subject video. There > are lots of schema libraries around that might help. > I guess you're talking about the "DOS" type attacks like nested arrays and stuff? Actually I think I will ignore these as the only "damage" this might cause is one hanging process in a desktop environment which should be easy to kill by the user... Best regards, J=C3=BCrgen --=20 You received this message because you are subscribed to the Google Groups "= zodb" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to [email protected]. For more options, visit https://groups.google.com/d/optout. --000000000000f7408c0580768889 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">Am Sa., 26. Jan. 2019 um= 19:00=C2=A0Uhr schrieb Jim Fulton <<a href=3D"mailto:[email protected]= ">[email protected]</a>>:<br></div><div class=3D"gmail_quote"><blockquo= te class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px = solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div dir=3D"ltr">= <br></div><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail-m_6437= 245375024889120gmail_attr">On Sat, Jan 26, 2019 at 8:10 AM 'Juergen Her= rmann' via zodb <<a href=3D"mailto:[email protected]" target=3D"= _blank">[email protected]</a>> wrote:<br></div><blockquote class=3D"= gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(20= 4,204,204);padding-left:1ex"><div dir=3D"ltr"><div dir=3D"ltr">My applicati= on is a GUI app that uses ZODB Filestorage files as it's storage format= and these files can be sent to other people who expect to be able to open = them without risk of their machine getting taken over. Makes sense?</div></= div></blockquote><div><br></div><div>Yup. Interesting.</div></div></div></b= lockquote><div><br></div><div>In case anybody is interesed i pasted a strip= ped down version of my FileStorage wrapper class here:</div><div><a href=3D= "https://pastebin.com/VvXJY3vP">https://pastebin.com/VvXJY3vP</a></div><div= ><br></div><div>I found the whole process of working with the ZODB as appli= cation file format simply wonderful and very straightforward!</div><div>=C2= =A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8e= x;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"= ><div class=3D"gmail_quote"><div>=C2=A0</div><blockquote class=3D"gmail_quo= te" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204= );padding-left:1ex"><div dir=3D"ltr"><div dir=3D"ltr"><div><br></div><div>I= think I solved the problem by overriding classFactory() in ZODB.DB.DB:</di= v><div><pre style=3D"background-color:rgb(43,43,43);color:rgb(169,183,198);= font-family:"DejaVu Sans Mono""><span style=3D"color:rgb(204,120,= 50)">class </span>XoverDB(DB):<br> <span style=3D"color:rgb(98,151,85);f= ont-style:italic">"""<br></span><span style=3D"color:rgb(98,= 151,85);font-style:italic"> derived from ZODB.DB.DB - overrides classFac= tory() to only allow<br></span><span style=3D"color:rgb(98,151,85);font-sty= le:italic"> import of very specific classes<br></span><span style=3D"col= or:rgb(98,151,85);font-style:italic"> """<br></span><span= style=3D"color:rgb(98,151,85);font-style:italic"> </span><span style=3D= "color:rgb(204,120,50)">def </span><span style=3D"color:rgb(255,198,109)">c= lassFactory</span>(<span style=3D"color:rgb(148,85,141)">self</span><span s= tyle=3D"color:rgb(204,120,50)">, </span>connection<span style=3D"color:rgb(= 204,120,50)">, </span>modulename<span style=3D"color:rgb(204,120,50)">, </s= pan>globalname):<br> <span style=3D"color:rgb(204,120,50)">if </span= >(modulename<span style=3D"color:rgb(204,120,50)">, </span>globalname) <spa= n style=3D"color:rgb(204,120,50)">not in </span>ALLOWED_MODULE_GLOBALS:<br>= <span style=3D"color:rgb(204,120,50)">raise </span><span style= =3D"color:rgb(136,136,198)">TypeError</span>(<span style=3D"color:rgb(106,1= 35,89)">"Not allowed to import global %r from module %r" </span>%= (globalname<span style=3D"color:rgb(204,120,50)">, </span>modulename))<br>= <span style=3D"color:rgb(204,120,50)">return </span><span style=3D"= color:rgb(136,136,198)">super</span>().classFactory(connection<span style= =3D"color:rgb(204,120,50)">, </span>modulename<span style=3D"color:rgb(204,= 120,50)">, </span>globalname)<br></pre></div></div><div>ALLOWED_MODULE_GLOB= ALS is a lsit of (modulename, globalname) tuples.</div><div><br></div><div>= Did I miss anything?</div></div></blockquote><div><br></div><div>That seems= reasonable to me.=C2=A0 If you're feeling especially paranoid, perhaps= you want some data validation logic in your application's __setstate__= methods (which you're probably not defining now) to protect against so= me of the other attacks mentioned in the subject video.=C2=A0 There are lot= s of schema libraries around that might help.</div></div></div></blockquote= ><div><br></div><div>I guess you're talking about the "DOS" t= ype attacks like nested arrays and stuff? Actually I think I will ignore th= ese as the only "damage" this might cause is one hanging process = in a desktop environment which should be easy to kill by the user...</div><= div><br></div><div>Best regards,</div><div>J=C3=BCrgen=C2=A0</div></div></d= iv></div> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;zodb" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:[email protected]">zodb+unsubscri= [email protected]</a>.<br /> For more options, visit <a href=3D"https://groups.google.com/d/optout">http= s://groups.google.com/d/optout</a>.<br /> --000000000000f7408c0580768889--