Is it possible to inject shell/python commands from a configuration file?
Question: Say you have a some meta data for a custom file format that your python app
reads. Something like a csv with variables that can change as the file is
manipulated:

    
    
    var1,data1
    var2,data2
    var3,data3
    

So if the user can manipulate this meta data, do you have to worry about
someone crafting a malformed meta data file that will allow some arbitrary
code execution? The only thing I can imagine if you you made the poor choice
to make `var1` be a shell command that you execute with `os.sys(data1)` in
your own code somewhere. Also, if this were C then you would have to worry
about buffers being blown, but I don't think you have to worry about that with
python. If your reading in that data as a string is it possible to somehow
escape the string `"\n os.sys('rm -r /')`, this SQL like example totally wont
work, but is there similar that is possible?


Answer: If you are doing what you say there (plain text, just reading and parsing a
simple format), you will be safe. As you indicate, Python is generally safe
from the more mundane memory corruption errors that C developers can create if
they are not careful. The SQL injection scenario you note is not a concern
when simply reading in files in python.

**However** , if you are concerned about security, which it seems you are
(interjection: good for you! A good programmer should be lazy _and_ paranoid),
here are some things to consider:

_Validate all input_. Make sure that each piece of data you read is of the
expected size, type, range, etc. Error early, and don't propagate tainted
variables elsewhere in your code.

  * Do you know the expected names of the vars, or at least their format? Make sure the validate that it is the kind of thing you expect before you use it. If it should be just letters, confirm that with a regex or similar.
  * Do you know the expected range or format of the data? If you're expecting a number, make sure it's a number before you use it. If it's supposed to be a short string, verify the length; you get the idea.
  * What if you get characters or bytes you don't expect? What if someone throws unicode at you? 
  * If any of these are paths, make sure you canonicalize and know that the path points to an acceptable location before you read or write. 

Some specific things **not** to do:

  * os.system(attackerControlledString)
  * eval(attackerControlledString)
  * `__import__(attackerControlledString)`
  * pickle/unpickle attacker controlled content ([here's why](http://nadiana.com/python-pickle-insecure))

Also, rather than rolling your own config file format, consider
[ConfigParser](http://docs.python.org/library/configparser.html) or something
like [JSON](http://www.json.org/). A well understood format (and libraries)
helps you get a leg up on proper validation.

OWASP would be my normal go-to for providing a "further reading" link, but
their Input Validation page needs help. In lieu, this looks like a reasonably
pragmatic read: "[Secure Programmer: Validating
Input](http://www.ibm.com/developerworks/library/l-sp2.html)". A slightly
dated but more python specific one is "[Dealing with User Input in
Python](http://tldp.org/LDP/LGNET/83/evans.html)"

