<div class="gmail_quote">On Fri, Jan 20, 2012 at 1:57 AM, Frank Sievertsen <span dir="ltr"><<a href="mailto:pydev@sievertsen.de">pydev@sievertsen.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><div class="im">
<blockquote type="cite">
<pre>The main issue with that approach is that it allows a new kind of attack.
</pre>
</blockquote>
<br></div>
Indeed, I posted another example:
<a href="http://bugs.python.org/msg151677" target="_blank">http://bugs.python.org/msg151677</a><br>
<br>
This kind of fix can be used in a specific application or maybe in a<br>
special-purpose framework, but not on the level of a general-purpose<br>
language.<span class="HOEnZb"><font color="#888888"><br></font></span></div></blockquote></div><br>Right. We are discussion this issue (for weeks now...) because it makes pretty much any Python app that takes untrusted data vulnerable, especially web apps, and after extensive analysis we came to the conclusion that defenses in the framework or in the app are really hard to do, very disruptive for developers, whereas preventing the attack by a modification of the dict or hash algorithms would fix it for everybody. And moreover, the attack would work against pretty much any Python web app using a set of evil strings computed once (hence encouraging script kiddies of just firing their fully-automatic weapon at random websites).<br>
<br>The new attacks that are now being considered require analysis of how the website is implemented, how it uses and stores data, etc. So an attacker has to sit down and come up with an attack tailored to a specific website. That can be dealt with on an ad-hoc basis.<br clear="all">
<br>-- <br>--Guido van Rossum (<a href="http://python.org/~guido">python.org/~guido</a>)<br>