Tag: security
All the articles with the tag "security".
Dangerous Python Functions, Part 3
A brief follow-up to the dangerous Python functions series, with an embedded exploit example for jsonpickle deserialization.
Answers to Django Security Questions
I found a list of Django security questions but couldn't find clear answers anywhere. So I dug in and wrote them myself, covering everything from CSRF and SQL injection to password hashing and mass assignment.
Using Bandit in the Field
A field report from testing Bandit on Python projects in 2015: running scans, interpreting warnings, and deciding which findings need attention.
Finding Vulnerabilities with Bandit
Slides from my SoCal Python talk on Bandit, including findings from scanning 16 open-source Python projects for potential security flaws.
Dangerous Python Functions, Part 2
The second installment covers pickle and YAML deserialization, SQL injection, and information leakage, with examples and safer alternatives.
Dangerous Python Functions
Examples of command and code injection through Python's shell calls, exec, and eval, with safer alternatives for handling untrusted input.