Hardening enviroment by overloading __import__?

[Steve Juranich]

If this is a FAQ, please let me know where the answer is.

I have in some code an 'eval', which I hate, but it's the shortest
path to where I need to get at this point. I thought that one way I
could harden the enviroment against malicious code would be to
temporarily disable the import statement by overloading __import__,
but I tried what seemed obvious to me, and it didn't work.

What I want do do is something like this:

def __import__(*arg s, **kwargs):
raise ImportError, 'Not so fast, bucko!'

eval(potentiall y_dangerous_str ing)

del __import__ # To get the builtin behavior back.

Am I barking up the wrong tree with __import__?? Where should I look
for this answer?

Thanks.
--
Steve Juranich
Tucson, AZ
USA

[Paul Rubin]

Steve Juranich <sj******@gmail .com> writes:

Am I barking up the wrong tree with __import__??
Yes.
Where should I look for this answer?

Don't.

[Steven Bethard]

Steve Juranich wrote:

I have in some code an 'eval', which I hate, but it's the shortest
path to where I need to get at this point.

What's this code trying to do? If you care about malicious code at all,
you'll avoid 'eval' completely. A couple reasons why:

With only a little trouble, I can get to the file object and write stuff
to your machine:

py> eval("().__clas s__.mro()[1].__subclasses__ ()[16]")
<type 'file'>

Sure, you can avoid this by supplying your own __builtins__ to disable
the file constructor:

py> eval("().__clas s__.mro()[1].__subclasses__ ()[16]('temp.txt')",
dict(__builtins __={}))
Traceback (most recent call last):
File "<interacti ve input>", line 1, in ?
File "<string>", line 0, in ?
IOError: file() constructor not accessible in restricted mode

But even without the file constructor, I can still access pretty much
any attribute of any class object by looking at object.__subcla sses__():

py> class C(object):
.... def __init__(self):
.... self.f = file('temp.txt' , 'w')
....
py> eval("().__clas s__.mro()[1].__subclasses__ ()[-1]().f.write('jun k')",
dict(__builtins __={}))
py> file('temp.txt' ).read()
'junk'

Moral of the story: don't use eval if you care about security!

STeVe