Python Security Cheatsheet Python Security Cheatsheet

import subprocess, shlex

# NO: the string is parsed by /bin/sh
subprocess.run(f"kubectl delete pod {name}", shell=True)
#   name = "web; rm -rf /tmp/x"  ->  two commands run

# YES: a list, no shell, arguments passed straight to execve
subprocess.run(["kubectl", "delete", "pod", name], check=True, timeout=30)

r = subprocess.run(["aws", "sts", "get-caller-identity"],
                   capture_output=True, text=True, check=True, timeout=15)
identity = json.loads(r.stdout)

import yaml

cfg = yaml.safe_load(open("values.yaml"))   # scalars, lists, dicts only
cfg = yaml.load(open("values.yaml"))        # can construct any Python object

import pickle, json

pickle.load(open(path, "rb"))      # arbitrary code execution, by design
json.load(open(path))              # data only

import secrets

secrets.token_urlsafe(32)      # URL-safe token, ~43 chars
secrets.token_hex(16)          # 32 hex chars
secrets.choice(alphabet)       # unguessable pick
secrets.compare_digest(a, b)   # constant-time comparison

import random
random.choice(alphabet)        # predictable: never for anything secret

# Comparing a token with == leaks its length and prefix through timing.
if secrets.compare_digest(provided_token, expected_token):
    ...

# NO: fast hashes are built to be fast, which is the wrong property here
hashlib.sha256(password.encode()).hexdigest()
hashlib.md5(password.encode()).hexdigest()

# YES: a slow, salted KDF
import hashlib, os
salt = os.urandom(16)
key = hashlib.scrypt(password.encode(), salt=salt, n=2**14, r=8, p=1, dklen=32)

# Better still, if you can take the dependency:
#   argon2-cffi  ->  argon2.PasswordHasher().hash(password)
#   bcrypt       ->  bcrypt.hashpw(pw, bcrypt.gensalt())

# NO: all three build SQL out of a value
cur.execute(f"SELECT * FROM pods WHERE name = '{name}'")
cur.execute("SELECT * FROM pods WHERE name = " + name)
cur.execute("SELECT * FROM pods WHERE name = %s" % name)

# YES: the driver sends the value separately from the statement
cur.execute("SELECT * FROM pods WHERE name = %s", (name,))          # psycopg
cur.execute("SELECT * FROM pods WHERE name = ?", (name,))           # sqlite3
cur.execute("SELECT * FROM pods WHERE name = %(n)s", {"n": name})   # named

import requests

requests.get(url, timeout=10)                 # verify=True is the default
requests.get(url, timeout=10, verify=False)   # NO: accepts any certificate
requests.get(url, timeout=10, verify="/etc/ssl/corp-ca.pem")  # private CA

import os
token = os.environ["API_TOKEN"]        # KeyError if missing: fail loudly
token = os.environ.get("API_TOKEN")    # None, then a confusing error later

# Pull from the platform rather than baking it in
import boto3
sm = boto3.client("secretsmanager")
secret = sm.get_secret_value(SecretId="prod/api")["SecretString"]
ssm = boto3.client("ssm")
val = ssm.get_parameter(Name="/prod/token", WithDecryption=True)["Parameter"]["Value"]

def mask(s: str, keep: int = 4) -> str:
    """Last 4 characters only, for log lines."""
    return "*" * max(0, len(s) - keep) + s[-keep:] if s else ""

from pathlib import Path

# NO: "../../etc/passwd" escapes the directory
target = base / user_supplied_name

# YES: resolve, then prove it is still inside
target = (base / user_supplied_name).resolve()
if not target.is_relative_to(base.resolve()):   # 3.9+
    raise ValueError("path escapes the base directory")

import tempfile
with tempfile.NamedTemporaryFile(delete=False) as fh:   # not /tmp/fixed-name
    fh.write(data)

os.chmod(path, 0o600)        # a secret on disk is owner-only

pip install pip-audit && pip-audit        # known CVEs in the environment
pip install --require-hashes -r requirements.txt
pip download --no-deps pkg && sha256sum pkg-*.whl

grep -rn "shell=True\|yaml.load(\|verify=False\|pickle.load\|eval(" --include=*.py .