《Python安全编码与代码审计》
    Thursday, May 26, 2016
    11:31 AM

    |

    | | —- |

    | Tags: #微博 |

    计算机生成了可选文字:
    酷勤网-程序员的那点事
    08/11/2015
    《Python安全编码与代码审计》现在一般的web开发框架安全已经做的挺好的了，比如大家常用的django，但是一些不规范的开发方式还是会导致一些常用的安全问题，下面就针对这些常用问题做一些总结。http://t.cn/RLm9ORj（来自： freebuf ）
    ![计算机生成了可选文字: : freebuf Pythofi±Rß-5ftEif 1 (phpftEäi+) , 2 xss defxsstest(request): name—request. GET [‘name’] retur nHttpResponse (name)) defxss_test(request): name—request. GET name’] *retu rnHttpResponse(‘ hello%s’ % (name)) return render to response(‘hello.html’, {‘name’: name}) 3 CSRF , dJango os.systemiöfishell fif51J+ def my serve (request, filename, dirname): re—serve (requ e st—request, path—filename, r name, show indexes: True) filestr=’ authExport. dat’ re Content— Disposition’ ] = ‘ attachment, filename:”‘ +urlquote (files tr)+’” ‘ fullname=os. path. join (dirname, filename) o s. sy stem(‘ %fullname) returnre , elfipythonä ( 1 ) shutil.rmtree ( 2 ) os.rmdir (3 ) os.remove , unlink os.system,os.popen,os.spaw,os.exec,os.open,os.po 5 sqli±Ä defgetUsers (user_i d=None): conn=psycopg2. connect (“db name = user = ‘host:” password:” cur=conn. cursor extras. Di ctC ursor) i str=’ select distinct_fromauth user’ else: str=’ select distinct*fromauth userwherei res=cur. execute (st r) res=cur. fetchall() conn. close() returnres defuse r contacts (request): user—request. GET usernam e’] contacts cursor—connection. cursor() cursor. execute (sql, [user] ) dosomethingwi ththeresults results—cursor. fetchone( ) results—cursor. fetchall() cursor. close ( ) eval , Ologin_required O newT ask_assess”) def targetLogin(request): req=simplejson . loads (request. POST loginarray’]) req=unicode (req) . encode (“u t f —8”) loginarray=eval (req) (request ‘ ipList’) 1364 decode (targets) (i plis holdobjs= [I pickle.loadsfif51J+ loads (“cosnsystemn(S’ un ame-a’ ntR. LinuxRCM-RSAS-V6-Dev3.9. O-aurora#4S11PP 6861nte1 (R) Core (TM) i 7- 2600CPIJ03. 40GHzGenuine1nte1GNIJ/Linux O Ologin_required •permission required (“accounts. new T askassess”) def exportLoginCheck (request, filename) ifre. match (r lic filename): fullname=filename else: I i c” print fullname return” ttpResponse (fullname) 8 8.1 , BTfiE#ßIddos , 8.2 xml , xxefiifio > (root > 192. 168. o. 2- 192. 168. O. 37” > > > from Ixmlimportetree parse test. xml’) > > >printetree. tostring(treel. getroot()) (root) (node id “192. 168. O. 2-192. 168. O. 37” daemon: x: sh sync: x: 4: 65534: sync:/bi n: / bin/ sync games: x: 5: 60: ma classXMLParser (_FeedParser) IXMLParser (self, encodin g=None, attribute_defaul ts=FaIse, dtd_vali dati on=FaIse , load clean=FaIse, recov er=FaIse, XML Schemaschema=None, remove blank text—Fal s e, resolve entities: True, remove comments=FaIse, remov strip_cdata=True, target=None, compact—Tru e) resolve entitles; True,no network; True, resolve , no networl& , Gpython 9.1 eval builtings__ bug84179 [xforxin(). class bases sub o classes .ifx. name “zipimporter”] [0] ( . 4. O—py2.5. eg “configobj”). o s. system (“uname”) > > > eval (s 2, l’ Linux O builtins 9.2 evec(), eval ( ) , o s. system(), o s. pop en ( ) , exec file(), input(), compile() 3 session F url python random whrandom / dev/ urandom’ ) data—n. read (I 28) 5 x s s 6 base64 ddos 9 session . http://t.cn/RLNLDt
    查看源微博
    已使用 Microsoft OneNote 2016 创建。