{"id":100875,"date":"2021-07-30T16:22:41","date_gmt":"2021-07-30T14:22:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/46-python-paketov-v-repozitorii-pypi-soderzhat-potenczialno-nebezopasnyj-kod"},"modified":"2021-07-30T16:22:41","modified_gmt":"2021-07-30T14:22:41","slug":"46-python-paketov-v-repozitorii-pypi-soderzhat-potenczialno-nebezopasnyj-kod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/46-python-paketov-v-repozitorii-pypi-soderzhat-potenczialno-nebezopasnyj-kod","title":{"rendered":"46% e paketeve Python n\u00eb repositorin PyPI p\u00ebrmbajn\u00eb kod potencialisht t\u00eb paqart\u00eb.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Nj\u00eb grup k\u00ebrkuesish nga Universiteti i Turku (Finland\u00eb) publikoi rezultatet e analiz\u00ebs s\u00eb paketeve n\u00eb repositorin PyPI p\u00ebr p\u00ebrdorimin e konstruktave potencialisht t\u00eb rrezikshme, q\u00eb mund t\u00eb \u00e7ojn\u00eb n\u00eb shfaqjen e dob\u00ebsive. Gjat\u00eb analiz\u00ebs s\u00eb 197 mij\u00eb paketeve u identifikuan 749 mij\u00eb probleme t\u00eb mundshme me sigurin\u00eb. N\u00eb 46% t\u00eb paketeve ka t\u00eb pakt\u00ebn nj\u00eb problem t\u00eb till\u00eb. Midis problemeve m\u00eb t\u00eb shpeshta jan\u00eb mang\u00ebsit\u00eb q\u00eb lidhen me trajtimin e jasht\u00ebsive dhe p\u00ebrdorimin e mund\u00ebsive q\u00eb lejojn\u00eb z\u00ebvend\u00ebsimin e kodit. <\/p>\n
Nga 749,000 probleme t\u00eb identifikuara, 442,000 (41%) jan\u00eb klasifikuar si t\u00eb par\u00ebnd\u00ebsishme, 227,000 (30%) si probleme me rrezik t\u00eb moderuar dhe 80,000 (11%) si t\u00eb rrezikshme. Disa paketa shk\u00ebputen nga masa e p\u00ebrgjithshme dhe p\u00ebrmbajn\u00eb mij\u00ebra probleme: p\u00ebr shembull, n\u00eb paket\u00ebn PyGGI jan\u00eb identifikuar 2,589 probleme, kryesisht t\u00eb lidhura me p\u00ebrdorimin e struktur\u00ebs \"try-except-pass\", nd\u00ebrsa n\u00eb paket\u00ebn appengine-sdk jan\u00eb gjetur 2,356 probleme. Nj\u00eb num\u00ebr i madh problemesh gjithashtu \u00ebsht\u00eb i pranish\u00ebm n\u00eb paketat genie.libs.ops, pbcore dhe genie.libs.parser. <\/p>\n
Duhet theksuar se rezultatet jan\u00eb marr\u00eb n\u00eb baz\u00eb t\u00eb kryerjes s\u00eb nj\u00eb analize statike automatike, e cila nuk merr parasysh kontekstin e p\u00ebrdorimit t\u00eb konstruktave t\u00eb caktuara. Zhvilluesi i instrumentit bandit, i cili u p\u00ebrdor p\u00ebr skanimin e kodit, shprehu mendimin se p\u00ebr shkak t\u00eb numrit t\u00eb konsideruesh\u00ebm t\u00eb alarmeve false, rezultatet e kontrollit nuk mund t\u00eb merren drejtp\u00ebrdrejt si dob\u00ebsi pa u kryer nj\u00eb rishikim manual t\u00eb \u00e7do problemi. <\/p>\n
P\u00ebr shembull, analizatori konsideron si nj\u00eb problem t\u00eb siguris\u00eb p\u00ebrdorimin e gjenerator\u00ebve t\u00eb rast\u00ebsish\u00ebm t\u00eb pasigurt dhe algoritmeve t\u00eb hashing, si\u00e7 \u00ebsht\u00eb MD5, nd\u00ebrsa n\u00eb kod k\u00ebto algoritme mund t\u00eb p\u00ebrdoren p\u00ebr q\u00ebllime q\u00eb nuk ndikojn\u00eb n\u00eb siguri. Analizatori gjithashtu konsideron si problem \u00e7do trajtim t\u00eb t\u00eb dh\u00ebnave t\u00eb jashtme n\u00eb funksione t\u00eb pasigurta, si\u00e7 jan\u00eb pickle, yaml.load, subprocess dhe eval, por ky p\u00ebrdorim nuk \u00ebsht\u00eb domosdoshm\u00ebrisht i lidhur me shfaqjen e dob\u00ebsive dhe n\u00eb t\u00eb v\u00ebrtet\u00eb p\u00ebrdorimi i funksioneve t\u00eb p\u00ebrmendura mund t\u00eb realizohet pa k\u00ebrc\u00ebnime t\u00eb siguris\u00eb. <\/p>\n
Midis kontrolleve t\u00eb p\u00ebrdorura n\u00eb studim: <\/p>\n
Caktimi i pasigurt i t\u00eb drejtave t\u00eb aksesit p\u00ebr skedar\u00ebt.\n
Bashkimi i soketeve rrjetor\u00eb me t\u00eb gjitha nd\u00ebrfaqet rrjetore.\n
P\u00ebrdorimi i fjal\u00ebkalimeve dhe \u00e7el\u00ebsave t\u00eb hardkoduar n\u00eb kod.\n
P\u00ebrdorimi i nj\u00eb katalogu t\u00eb paracaktuar temporar.\n
P\u00ebrdorimi i pass dhe continue n\u00eb trajtuesit e p\u00ebrjashtimeve t\u00eb stilit catch-all;\n
Ekzekutimi i aplikacioneve web mbi baz\u00ebn e framework-ut web Flask me modalitetin e debukimit aktiv.\n
P\u00ebrdorimi i metodave t\u00eb pasigurta t\u00eb deserializimit t\u00eb t\u00eb dh\u00ebnave.\n
P\u00ebrdorimi i funksioneve hash MD2, MD4, MD5 dhe SHA1.\n
P\u00ebrdorimi i algoritmeve t\u00eb pasigurta t\u00eb enkriptimit DES dhe modet e enkriptimit.\n
P\u00ebrdorimi i nj\u00eb implementimi t\u00eb pasigurt t\u00eb HTTPSConnection n\u00eb disa versione t\u00eb Python.\n
D\u00ebftimi i skem\u00ebs file:\/\/ n\u00eb urlopen.\n
P\u00ebrdorimi i gjenerator\u00ebve t\u00eb numrave pseudologjik\u00eb p\u00ebr ekzekutimin e detyrave kriptografike.\n
P\u00ebrdorimi i protokollit Telnet.\n
P\u00ebrdorimi i parser\u00ebve XML t\u00eb pasigurt. <\/ul>\n
P\u00ebr m\u00eb tep\u00ebr, mund t\u00eb v\u00ebrehet se jan\u00eb zbuluar 8 paketa malinj n\u00eb katalogun PyPI. Para heqjes, paketat problematike kishin arritur t\u00eb shkarkoheshin m\u00eb shum\u00eb se 30 mij\u00eb her\u00eb. P\u00ebr t\u00eb fshehur aktivitetin malinj dhe p\u00ebr t\u00eb anashkaluar paralajm\u00ebrimet e analist\u00ebve statik\u00eb t\u00eb thjesht\u00eb, n\u00eb paketat ishte p\u00ebrdorur kodimi i blloqeve t\u00eb kodit me ndihm\u00ebn e Base64 dhe organizimi i ekzekutimit pas dekodimit p\u00ebrmes thirrjes eval. <\/p>\n
N\u00eb paketat noblesse, genesisbot, are, suffer, noblesse2 dhe noblessev2 \u00ebsht\u00eb zbuluar nj\u00eb kod p\u00ebr kapjen e numrave t\u00eb kartave t\u00eb kreditit dhe fjal\u00ebkalimeve t\u00eb ruajtura n\u00eb shfletuesit Chrome dhe Edge, si dhe p\u00ebr transmetimin e tokeneve t\u00eb llogarive nga aplikacioni Discord dhe d\u00ebrgimin e t\u00eb dh\u00ebnave t\u00eb sistemit, duke p\u00ebrfshir\u00eb copje t\u00eb p\u00ebrmbajtjes s\u00eb ekranit. N\u00eb paketat pytagora dhe pytagora2 kishte mund\u00ebsi p\u00ebr shkarkimin dhe ekzekutimin e kodit ekzekutiv t\u00eb pal\u00ebve t\u00eb treta. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"