{"id":117354,"date":"2024-07-12T09:43:01","date_gmt":"2024-07-12T07:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python"},"modified":"2024-07-12T09:43:01","modified_gmt":"2024-07-12T07:43:01","slug":"utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python","title":{"rendered":"Token nopl\u016bde pilnai piek\u013cuvei GitHub projekta Python repositu\u0101riem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

P\u0113tnieki no uz\u0146\u0113muma JFrog atkl\u0101ja Docker att\u0113la 'cabotage-app' sast\u0101v\u0101 tokenu, kas nodro\u0161ina administratora piek\u013cuvi Python, PyPI un Python Software Foundation repozitorijiem GitHub. Token tika atrasts bin\u0101raj\u0101 fail\u0101 '__pycache__\/build.cpython-311.pyc' ar ke\u0161atmi\u0146\u0101 saglab\u0101tu kompil\u0113to bajtkodu.

\"Token<\/center> <\/p>\n

Saska\u0146\u0101 ar PyPI repositu\u0101ra p\u0101rst\u0101vju zi\u0146ojumu, tokens tika izveidots 2023. gad\u0101 izstr\u0101d\u0101t\u0101jam ewdurbin (Ee Durbin), kur\u0161 ie\u0146em infrastrukt\u016bras direktora amatu Python Software Foundation. Token nodro\u0161in\u0101ja administrat\u012bvu piek\u013cuvi visiem projekta repositu\u0101riem un organiz\u0101cij\u0101m, tostarp visiem pypi, python, psf un pypa organiz\u0101ciju repositu\u0101riem. Probl\u0113mas Docker att\u0113ls ar tokenu tika public\u0113ts Docker Hub katalog\u0101 2023. gada 3. mart\u0101 un tika dz\u0113sts 2024. gada 11. j\u016bnij\u0101, t.i., 16 m\u0113ne\u0161us tas bija pieejams publiski. Token tika atsaukts 2023. gada 28. j\u016bnij\u0101. <\/p>\n

Iev\u0113r\u012bbu piesaista fakts, ka pieejamajos avota kods, uz kura b\u0101zes tika \u0123ener\u0113ts problem\u0101tiskais bajtkod\u0101 fails, tokena min\u0113juma nav. Koda autors paskaidroja, ka izstr\u0101d\u0101jot r\u012bku cabotage-app5 sav\u0101 viet\u0113j\u0101 sist\u0113m\u0101 sask\u0101r\u0101s ar API GitHub piepras\u012bjumu intensit\u0101tes ierobe\u017eojumiem, un, lai apietu ierobe\u017eojumus, kas noteikti anon\u012bmajiem piepras\u012bjumiem uz GitHub, pagaidu laik\u0101 pievienoja savu darba tokenu kodam. Pirms public\u0113t\u0101 koda izlai\u0161anas tokena min\u0113jums tika dz\u0113sts, ta\u010du izstr\u0101d\u0101t\u0101js ne\u0146em v\u0113r\u0101, ka tokena min\u0113jums tika ke\u0161ots iepriek\u0161 kompil\u0113taj\u0101 bajtkoda fail\u0101, kas p\u0113c tam non\u0101ca docker att\u0113l\u0101. def _fetch_github_file( \u2014 github_repository='owner\/repo', ref='main', access_token=None, filename='Dockerfile' + github_repository='owner\/repo', + ref='main', + access_token='0d6a9bb5af126f73350a2afc058492765446aaad', + filename='Dockerfile', ): <\/p>\n

Izstr\u0101d\u0101t\u0101ju veikt\u0101 Python aktivit\u0101tes audita anal\u012bze GitHub repositu\u0101ros neuzr\u0101d\u012bja nek\u0101das \u0101r\u0113j\u0101s piek\u013cuves m\u0113\u0123in\u0101jumus, izmantojot atkl\u0101to token. \u0145emot v\u0113r\u0101 to, ka kop\u0161 2017. gada GitHub ir prim\u0101r\u0101 platforma CPython izstr\u0101dei, tokena non\u0101k\u0161ana \u013caunpr\u0101t\u012bgo personu rok\u0101s var\u0113tu rad\u012bt piln\u012bgu infrastrukt\u016bras kompromit\u0101ciju, kas tiek izmantota Python un PyPI repositu\u0101ra izstr\u0101d\u0113, k\u0101 ar\u012b \u013cautu m\u0113\u0123in\u0101jumiem integr\u0113t backdoor CPython un paket\u0146u p\u0101rvaldniek\u0101 PyPI. <\/p>\n

Incidents demonstrate the importance of analyzing leaks not only in source code, configuration files, and environment variables, but also in binary files. In the context of Python, users are also advised to pay attention to the presence of pyc files with compiled bytecode in downloaded projects, as these files may contain hidden modifications that are absent in the source code.
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 JFrog \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 Docker-\u043e\u0431\u0440\u0430\u0437\u0430 «cabotage-app» \u0442\u043e\u043a\u0435\u043d, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c Python, PyPI \u0438 Python Software Foundation \u043d\u0430 GitHub. \u0422\u043e\u043a\u0435\u043d \u0431\u044b\u043b \u043d\u0430\u0439\u0434\u0435\u043d \u0432 \u0431\u0438\u043d\u0430\u0440\u043d\u043e\u043c \u0444\u0430\u0439\u043b\u0435 «__pycache__\/build.cpython-311.pyc» \u0441 \u043f\u0440\u043e\u043a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0441\u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0431\u0430\u0439\u0442\u043a\u043e\u0434\u043e\u043c. \u041f\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044e \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0435\u0439 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f PyPI \u0442\u043e\u043a\u0435\u043d \u0431\u044b\u043b \u0441\u043e\u0437\u0434\u0430\u043d \u0432 2023 \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 ewdurbin (Ee Durbin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":117355,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-117354","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u017detona nopl\u016bde ar piln\u012bgu piek\u013cuvi Python projekta GitHub repozit\u0101riem | ProHoster","description":"Izp\u0113tes speci\u0101listi no uz\u0146\u0113muma JFrog atkl\u0101ja Docker att\u0113la \"cabotage-app\" sast\u0101v\u0101 \u017eetonu, kas nodro\u0161ina piek\u013cuvi ar administratora ties\u012bb\u0101m Python, PyPI un Python Software Foundation repozit\u0101riem GitHub.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0442\u0435\u0447\u043a\u0430 \u0442\u043e\u043a\u0435\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a GitHub-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Python | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 JFrog \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 Docker-\u043e\u0431\u0440\u0430\u0437\u0430 "cabotage-app" \u0442\u043e\u043a\u0435\u043d, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c Python, PyPI \u0438 Python Software Foundation \u043d\u0430 GitHub.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-12T07:43:01+00:00","article:modified_time":"2024-07-12T07:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"117354","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 04:04:30","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 04:04:30","updated":"2026-01-23 04:04:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/117354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=117354"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/117354\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media\/117355"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=117354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=117354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=117354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}