Date: Tue, 9 Sep 2014 11:16:44 +0300 From: Mikko Korpela <mikko.korpela@...il.com> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: Re: pinocchio tmp vuln This pinocchio sounds like a cool testing tool. I have to say I don't understand at all why someone would be going through random packages from PyPi (especially test automation related) and searching for possible security issues. Could someone explain why this kind of security issues (malicious user making a symlink to some random file that is used during testing) should be in the scope of test automation tools? 2014-09-09 9:26 GMT+03:00 David Jorm <djorm@...hat.com>: > On 09/09/2014 04:21 PM, Kurt Seifried wrote: >> >> https://pypi.python.org/pypi/pinocchio/ >> >> pinocchio stopwatch --with-stopwatch Select tests based >> on execution time >> >> pinocchio-0.4.1/pinocchio/stopwatch.py >> >> def finalize(self, result): >> """ >> Save the recorded times, OR dump them into /tmp if the file >> open fails. >> """ >> try: >> fp = open(self.stopwatch_file, 'w') >> except (IOError, OSError): >> t = int(time.time()) >> filename = '/tmp/nose-stopwatch-%s.pickle' % (t,) >> >> int(time.time) is easily guessed, create a few thousand and you're >> covered for the next few hours and can stop anyone from using stopwatch, >> or you can just blow away files as usual =). >> >> fp = open(filename, 'w') >> log.warning('WARNING: stopwatch cannot write to "%s"' % >> (self.stopwatch_file)) >> log.warning('WARNING: stopwatch is using "%s" to save times' >> % (filename,)) >> >> dump(self.times, fp) >> fp.close() >> >> >> >> > > You're a troll :) -- Mikko Korpela
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.