Iqembu labacwaningi abavela eNyuvesi yaseTurku (eFinland) lishicilele imiphumela yokuhlaziywa kwamaphakheji endaweni ye-PyPI ukuze kusetshenziswe izakhiwo ezingase zibe yingozi ezingaholela ekubeni sengozini. Ngesikhathi kuhlaziywa amaphakheji ayizinkulungwane eziyi-197, kuhlonzwe izinkinga zokuphepha ezingaba yizinkulungwane ezingama-749. Amaphesenti angu-46 amaphakheji okungenani anenkinga eyodwa enjalo. Phakathi kwezinkinga ezivame kakhulu ukushiyeka okuhlobene nokuphatha okuhlukile kanye nokusetshenziswa kwezici ezivumela ukushintshwa kwekhodi.
Ezinkingeni eziyizinkulungwane ezingama-749 ezihlonziwe, izinkulungwane ezingama-442 (41%) zibhalwe njengezincane, izinkulungwane ezingama-227 (30%) njengezinkinga ezimaphakathi kanye nezinkulungwane ezingama-80 (11%) njengeziyingozi. Amanye amaphakheji avela esixukwini futhi aqukethe izinkulungwane zezinkinga: isibonelo, iphakethe le-PyGGI lihlonze izinkinga ezingu-2589, ikakhulukazi ezihlobene nokusetshenziswa kokwakhiwa kwe-"try-ngaphandle-pass", futhi iphakheji ye-appengine-sdk ithole izinkinga ezingu-2356. Inombolo enkulu yezinkinga nayo ikhona kumaphakheji we-genie.libs.ops, pbcore kanye ne-genie.libs.parser.
Kumele kuqashelwe ukuthi imiphumela yatholwa ngokusekelwe ekuhlaziyweni kwe-static okuzenzakalelayo, okungacabangi umongo wokusetshenziswa kwezakhiwo ezithile. Umthuthukisi wekhithi yamathuluzi yezigelekeqe, eyasetshenziswa ukuskena ikhodi, uzwakalise umbono wokuthi ngenxa yenani eliphezulu lezinto ezingamanga, imiphumela yokuskena ayikwazi ukubhekwa njengengcuphe ngaphandle kokubuyekezwa okwengeziwe mathupha kokukhishwa ngakunye.
Isibonelo, umhlaziyi ubheka ukusetshenziswa kwamajeneretha ezinombolo angathembekile nama-hashing algorithms, njenge-MD5, njengenkinga yezokuphepha, kuyilapho kukhodi ama-algorithms anjalo angase asetshenziselwe izinjongo ezingathinti ukuphepha. I-analyzer iphinde icabangele noma yikuphi ukucutshungulwa kwedatha yangaphandle emisebenzini engaphephile efana ne-pickle, yaml.load, subprocess kanye ne-eval njengenkinga, kodwa lokhu kusetshenziswa akubandakanyi ubungozi futhi empeleni ukusetshenziswa kwale misebenzi kungenziwa ngaphandle kosongo lwezokuphepha. .
Phakathi kwezivivinyo ezisetshenziswe ocwaningweni:
- Ukusebenzisa imisebenzi okungenzeka ayiphephile i-exec, mktemp, eval, mark_safe, njll.
- Ukulungiselelwa okungavikelekile kwamalungelo okufinyelela kumafayela.
- Ukunamathisela isokhethi yenethiwekhi kuzo zonke izixhumi ezibonakalayo zenethiwekhi.
- Ukusetshenziswa kwamaphasiwedi nokhiye abalulwe ngokuqinile kukhodi.
- Kusetshenziswa uhla lwemibhalo lwesikhashana oluchazwe ngaphambilini.
- Ukusebenzisa iphasi futhi uqhubeke kuzibambi ezihlukile zezitayela zokubamba;
- Kwethulwa izinhlelo zokusebenza zewebhu ezisuselwe kuhlaka lwewebhu ye-Flask enemodi yokulungisa iphutha enikwe amandla.
- Ukusebenzisa izindlela ezingaphephile zokususa idatha.
- Isebenzisa imisebenzi ye-MD2, MD4, MD5 kanye ne-SHA1 hashi.
- Ukusetshenziswa kwamacipher we-DES angavikelekile nezindlela zokubethela.
- Ukusetshenziswa kokusetshenziswa okungavikelekile kwe-HTTPSConnection kwezinye izinguqulo zePython.
- Icacisa ifayela:// isikimu ku-urlopen.
- Ukusebenzisa amajeneretha ezinombolo ze-pseudorandom lapho wenza imisebenzi ye-cryptographic.
- Ukusebenzisa iphrothokholi ye-Telnet.
- Kusetshenziswa abahlaluli be-XML abangavikelekile.
Ukwengeza, kungaqashelwa ukuthi amaphakheji anonya angu-8 atholwe kuhla lwemibhalo lwe-PyPI. Ngaphambi kokususwa, amaphakheji ayinkinga alandwe izikhathi ezingaphezu kwezinkulungwane ezingama-30. Ukuze ufihle umsebenzi omubi futhi udlule izexwayiso kubahlaziyi abalula abamile kumaphakheji, amabhulokhi ekhodi afakwe ikhodi kusetshenziswa i-Base64 futhi asetshenziswa ngemva kokuqoshwa kusetshenziswa ikholi ye-eval.
Amaphakheji we-noblesse, i-genesisbot, ayahlupheka, i-noblesse2 kanye ne-noblessev2 aqukethe ikhodi yokuthola izinombolo zekhadi lesikweletu namaphasiwedi agcinwe kuziphequluli ze-Chrome ne-Edge, kanye nokudlulisa amathokheni e-akhawunti kusuka kuhlelo lokusebenza lwe-Discord nokuthumela idatha yesistimu, okuhlanganisa nezithombe-skrini zokuqukethwe kwesikrini . Amaphakheji we-pytagora ne-pytagora2 afaka ikhono lokulayisha nokusebenzisa ikhodi esebenzisekayo evela eceleni.
Source: opennet.ru