[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 9 Sep 2014 11:16:44 +0300
From: Mikko Korpela <mikko.korpela@...il.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: pinocchio tmp vuln
This pinocchio sounds like a cool testing tool.
I have to say I don't understand at all why someone would be going
through random packages from PyPi (especially test automation related)
and searching for possible security issues.
Could someone explain why this kind of security issues (malicious user
making a symlink to some random file that is used during testing)
should be in the scope of test automation tools?
2014-09-09 9:26 GMT+03:00 David Jorm <djorm@...hat.com>:
> On 09/09/2014 04:21 PM, Kurt Seifried wrote:
>>
>> https://pypi.python.org/pypi/pinocchio/
>>
>> pinocchio stopwatch --with-stopwatch Select tests based
>> on execution time
>>
>> pinocchio-0.4.1/pinocchio/stopwatch.py
>>
>> def finalize(self, result):
>> """
>> Save the recorded times, OR dump them into /tmp if the file
>> open fails.
>> """
>> try:
>> fp = open(self.stopwatch_file, 'w')
>> except (IOError, OSError):
>> t = int(time.time())
>> filename = '/tmp/nose-stopwatch-%s.pickle' % (t,)
>>
>> int(time.time) is easily guessed, create a few thousand and you're
>> covered for the next few hours and can stop anyone from using stopwatch,
>> or you can just blow away files as usual =).
>>
>> fp = open(filename, 'w')
>> log.warning('WARNING: stopwatch cannot write to "%s"' %
>> (self.stopwatch_file))
>> log.warning('WARNING: stopwatch is using "%s" to save times'
>> % (filename,))
>>
>> dump(self.times, fp)
>> fp.close()
>>
>>
>>
>>
>
> You're a troll :)
--
Mikko Korpela
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
