Hacker News Reader

Comment by neilv | Hacker News Reader

Nice catch. IMHO, it's a little too obvious, so probably not a bugdoor. Maybe someone who knows better wasn't getting enough sleep.

View on HN

Can someone explain for those of us who aren't as savvy?

I know just a little bit of python and that looks like it does what the description says. Maybe I wouldn't use subprocess but do it via the standard lib.

What should we be looking for in the code?

shell=True is a security risk unless you're very careful with escaping inputs. In this case any filename with a `;` in it (or various other shell characters) will run arbitrary commands on the attacker's computer.

best to pass a list of arguments to subprocess rather than a string, and avoid shell=True

I never understood why there even is an api for using a string...

Same for SQL statements, single quotes in a query string should generate a warning to just use prepared statements instead :-)

Ah true! I fixated on exactly the line that was marked. I guess it's not that bad because you're choosing the file to copy, but I wouldn't have used a subshell for copying a file anyway.

With a well-crafted filename, you can run arbitrary commands on the attackers computer.

Python is a pretty big "I don't know what I'm doing" flag so I wouldn't be too surprised. Not always of course - there are plenty of well written Python projects - but Python and JavaScript are so popular for beginners that projects written by beginners tend to concentrate in those languages.

and you know what you're doing, aren't you? lol

Yes I do know how to avoid basic string injection vulnerabilities.

sit down rust boy.

Reply on news.ycombinator.com