Re: Google Apps Engine

> Even those could easily be sanitized by just some fun with function
> pointers.
>
> >>> open=lambda *x: "no"
> >>> open('/etc/passwd')
> 'no'

Unless there are other ways to find these functions:

>>> __builtins__.__dict__["open"]( '/etc/passwd')
    <open file '/etc/passwd', mode 'r' at 0xb7dac7b8>

or even:

>>> open=lambda *x: "no"
>>> open('/etc/passwd')
    'no'
>>> del open
>>> open('/etc/passwd')
    <open file '/etc/passwd', mode 'r' at 0xb7db44a0>

Python is fun, there are so many ways to have it do what you want ;)

It might be possible to remove these functions like this:

>>> del __builtins__.__dict__["open"]
>>> open('/etc/passwd')
    Traceback (most recent call last):
      File "<stdin>", line 1, in <module>
    NameError: name 'open' is not defined
    [...]

But i don't know whether that'd get rid of all problems.

Best regards,

Lutz

_______________________________________________
Dailydave mailing list
Dailydave_at_lists.immunitysec.com
http://lists.immunitysec.com/mailman/listinfo/dailydave