Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 29 Sep 2014 16:05:45 -0400 (EDT)
Subject: Re: Pylint checks not as static as one would think

Hash: SHA1

> Pylint is advertised as "a static code checker, meaning it can
> analyse your code without actually running it"[1] and that it "does
> not import live modules"[1].
> This is, unfortunately, far from reality. Here's a PoC:
> $ cat
> from _moo import *
> $ cat moo.c
> #include <stdio.h>
> #include <signal.h>
> void __attribute__((constructor)) moo() {
>         printf("moo!\n");
>         kill(0, SIGSEGV);
> }
> $ gcc -Wall -shared -fPIC moo.c -o
> $ pylint
> No config file found, using default configuration
> moo!
> My understanding is that upstream Pylint maintainers consider this 
> behavior intentional[2]. But even then, I think it's a serious 
> documentation flaw.
> [1]
> [2]

We think there's a valid alternate interpretation of the

> it can analyse your code without actually running it

This describes the general functionality of the product, without
commenting on whether code might be run in some circumstances. If the
user provides exclusively Python source code, and doesn't provide
mixed input containing both Python source code and potentially
malicious .so files, then the situation is different.

> There are a few other differences, such as the fact that Pylint does
> not import live modules while Pychecker does

This can be interpreted to mean "if you want a product with an
explicit strategy of importing live modules in order to find a wider
class of problems, then choose Pychecker instead of Pylint." A brief
statement that contrasts major features, in general terms, is not
equivalent to something like:

  [hypothetical] 6.x Is import of live modules always prevented?
  Yes, this is an explicit security constraint in our design.

We agree that it would be a significant security improvement to have
clearer documentation, e.g.,

  [hypothetical] 6.y Is import of live modules always prevented?
  No, astng does import live modules when source is unavailable.

but we feel there is no vulnerability and thus no CVE.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through ]
Version: GnuPG v1.4.14 (SunOS)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.