{"id":100875,"date":"2021-07-30T16:22:41","date_gmt":"2021-07-30T14:22:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/46-python-paketov-v-repozitorii-pypi-soderzhat-potenczialno-nebezopasnyj-kod"},"modified":"2021-07-30T16:22:41","modified_gmt":"2021-07-30T14:22:41","slug":"46-python-paketov-v-repozitorii-pypi-soderzhat-potenczialno-nebezopasnyj-kod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/46-python-paketov-v-repozitorii-pypi-soderzhat-potenczialno-nebezopasnyj-kod","title":{"rendered":"46% e paketave Python n\u00eb depozita PyPI p\u00ebrmbajn\u00eb kod potencialisht t\u00eb pasigurt","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Nj\u00eb grup studiuesish nga Universiteti i Turku (Finland\u00eb) publikoi rezultatet e analiz\u00ebs s\u00eb paketave n\u00eb repositorin PyPI p\u00ebr p\u00ebrdorimin e konstruktimeve potencialisht t\u00eb rrezikshme q\u00eb mund t\u00eb \u00e7ojn\u00eb n\u00eb shfaqjen e dob\u00ebsive. Gjat\u00eb analiz\u00ebs s\u00eb 197 mij\u00eb paketave, u zbuluan 749 mij\u00eb probleme potenciale me sigurin\u00eb. N\u00eb 46% t\u00eb paketave, ka t\u00eb pakt\u00ebn nj\u00eb problem t\u00eb till\u00eb. Midis problemeve m\u00eb t\u00eb zakonshme jan\u00eb dob\u00ebsit\u00eb e lidhura me menaxhimin e p\u00ebrjashtimeve dhe p\u00ebrdorimin e mund\u00ebsive q\u00eb lejojn\u00eb mbivendosjen e kodit. <\/p>\n
Duhet theksuar se rezultatet jan\u00eb marr\u00eb n\u00eb baz\u00eb t\u00eb realizimit t\u00eb nj\u00eb analize statike automatizimi, e cila nuk merr parasysh kontekstin e p\u00ebrdorimit t\u00eb konstruktimeve t\u00eb caktuara. Zhvilluesi i mjetit bandit, i cili u p\u00ebrdor p\u00ebr skanimin e kodit, shprehu mendimin se p\u00ebr shkak t\u00eb nj\u00eb numri t\u00eb lart\u00eb t\u00eb sinjaleve false, rezultatet e kontrollit nuk mund t\u00eb merren drejtp\u00ebrdrejt si dob\u00ebsi pa u realizuar nj\u00eb rishikim manual t\u00eb \u00e7do problemi. <\/p>\n
P\u00ebr shembull, analizuesi e konsideron si nj\u00eb problem sigurie p\u00ebrdorimin e gjeneruesve t\u00eb rast\u00ebsish\u00ebm t\u00eb pasigurt dhe algoritmeve t\u00eb hashing, si MD5, nd\u00ebrsa n\u00eb kod k\u00ebto algoritme mund t\u00eb p\u00ebrdoren p\u00ebr q\u00ebllime q\u00eb nuk ndikojn\u00eb n\u00eb siguri. Analizuesi gjithashtu e konsideron si problem \u00e7do trajtim t\u00eb t\u00eb dh\u00ebnave t\u00eb jashtme n\u00eb funksione t\u00eb pasigurta, si pickle, yaml.load, subprocess dhe eval, por ky p\u00ebrdorim nuk \u00ebsht\u00eb domosdoshm\u00ebrisht i lidhur me shfaqjen e dob\u00ebsive dhe mund t\u00eb implementohet pa rrezik nga siguria. <\/p>\n
Nd\u00ebr kontrollet e p\u00ebrdorura n\u00eb hulumtim: <\/p>\n
Vendosja e pasigurt e t\u00eb drejtave t\u00eb aksesit p\u00ebr skedar\u00ebt.\n
Kjornimi i nj\u00eb soketi rrjeti n\u00eb t\u00eb gjith\u00eb nd\u00ebrfaqet rrjet\u00eb.\n
P\u00ebrdorimi i password-eve dhe \u00e7el\u00ebsave t\u00eb koduar ngusht\u00eb n\u00eb kod.\n
P\u00ebrdorimi i nj\u00eb katalogu t\u00eb p\u00ebrkohsh\u00ebm t\u00eb paracaktuar.\n
P\u00ebrdorimi i pass dhe continue n\u00eb menaxher\u00ebt e p\u00ebrjashtimeve n\u00eb stilin catch-all;\n
\u00c7el\u00ebsi i aplikacioneve web t\u00eb bazuara n\u00eb \u00e7arjen e web-it Flask me modin debug t\u00eb aktivizuar.\n
P\u00ebrdorimi i metodave t\u00eb pasigurta t\u00eb deserializimit t\u00eb t\u00eb dh\u00ebnave.\n
P\u00ebrdorimi i funksioneve t\u00eb hashing MD2, MD4, MD5 dhe SHA1.\n
P\u00ebrdorimi i enkripcioneve t\u00eb pasigura DES dhe m\u00ebnyrat e enkriptimit.\n
P\u00ebrdorimi i implementimit t\u00eb pasigurt t\u00eb HTTPSConnection n\u00eb disa versione t\u00eb Python.\n
Specifikimi i skem\u00ebs file:\/\/ n\u00eb urlopen.\n
P\u00ebrdorimi i gjeneruesve t\u00eb numrave pseudo-rast\u00ebsor p\u00ebr realizimin e detyrave kriptografike.\n
P\u00ebrdorimi i protokollit Telnet.\n
P\u00ebrdorimi i parser\u00ebve t\u00eb pasigurt XML. <\/ul>\n
S\u00eb fundmi, duhet t\u00eb theksoj se, n\u00eb katalogun PyPI jan\u00eb zbuluar 8 paketa keqb\u00ebr\u00ebse. Para se t\u00eb fshiheshin, paketa problematike kishin realizuar m\u00eb shum\u00eb se 30 mij\u00eb shkarkime. P\u00ebr t\u00eb fshehur aktivitetet e d\u00ebmshme dhe p\u00ebr t\u00eb anashkaluar paralajm\u00ebrimet e analizator\u00ebve static\u00eb t\u00eb thjesht\u00eb, n\u00eb paketa u p\u00ebrdor kodimi i blloqeve me kod duke p\u00ebrdorur Base64 dhe organizimi i ekzekutimit pas dekodimit p\u00ebrmes thirrjes eval. <\/p>\n
N\u00eb paketat noblesse, genesisbot, are, suffer, noblesse2 dhe noblessev2 u zbulua nj\u00eb kod p\u00ebr kapjen e numrave t\u00eb kartave t\u00eb kreditit dhe fjal\u00ebkalimeve t\u00eb ruajtura n\u00eb shfletuesit Chrome dhe Edge, si dhe p\u00ebr transmetimin e tokeneve t\u00eb llogarive nga aplikacioni Discord dhe d\u00ebrgimin e t\u00eb dh\u00ebnave t\u00eb sistemit, duke p\u00ebrfshir\u00eb screenshotet e p\u00ebrmbajtjes s\u00eb ekranit. N\u00eb paketat pytagora dhe pytagora2 kishte mund\u00ebsi p\u00ebr t\u00eb shkarkuar dhe ekzekutuar kodin e tret\u00eb. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"