How can locals() be exploited in python code?

Question

I stumbled across the following warning when I was reading Code Like a Pythonista: Idiomatic Python by David Goodger.

Excerpt from the article ...
print('Hello %(name)s, you have %(messages)i messages' % locals())
This is very powerful. With this, you can do all the string formatting you want without having to worry about matching the interpolation values to the template.

But power can be dangerous. "With great power comes great responsibility." If you use the locals() from with an externally-supplied template string, you expose your entire local namespace to the caller. This is just something to keep in mind.

I am trying to understand the specific scenarios in which using locals() can be dangerous. Any examples of how the presence of locals() in a code can be exploited are appreciated. Thanks!

yan · Accepted Answer · 2011-04-07 18:30:00Z

6

Sample, trivial code:

script_name = 'readpw.py'
...
entered_pw = raw_input()
if entered_pw != real_pw:
    print "%(script_name)s: The password you entered: "+entered_pw+" is incorrect."%locals()

Consider the case where entered_pw is %(real_pw)s

answered Apr 7, 2011 at 18:30

yan

21k3 gold badges41 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Martin Thurau · Accepted Answer · 2011-04-07 18:28:52Z

4

A simple example: If you have some magic ultra important encryption key enc_key in your local namespace of a webapp-view and you would use a user supplied string in this way:

 a_var_that_gets_display = user_supplied_string % locals()

Than an attacker could pass something like Encryption key is %(enc_key)s as user_supplied_stringand would get your key.

I admit that this a highly unlikely and constructed example. Generally using locals() is save as long as you don't use user supplied data as format string.

answered Apr 7, 2011 at 18:28

Martin Thurau

7,6847 gold badges46 silver badges80 bronze badges

Collectives™ on Stack Overflow

How can locals() be exploited in python code?

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related