The potential security vulnerability for the flag pre_dispatch in Parallel() class due to the eval() statement.
See original GitHub issueAs the title shows, if you try to enter a statement in the flag pre_dispatch
, it will run whatever you want to run.
This should present a potential security vulnerability.
def f():
return 1
p = Parallel(n_jobs=3, pre_dispatch="sys.exit(0)")
p(delayed(f)() for i in range(10)) # this will cause the system to exit
Issue Analytics
- State:
- Created 3 years ago
- Comments:12 (8 by maintainers)
Top Results From Across the Web
CVE-2022-21797 Detail - NVD
0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement. Severity. CVSS Version 3 ......
Read more >NDK Revision History
This page provides information on changes in all released stable versions of the NDK. To download the latest stable version of the NDK...
Read more >Why is using 'eval' a bad practice? - python
Yes, using eval is a bad practice. Just to name a few reasons: There is almost always a better way to do it;...
Read more >3rd USENIX Conference on Web Application Development ( ...
model the potential code paths grow beyond feasibility. Instead, we propose a simple, ... pre-dispatch ... To do so, the library uses an...
Read more >Diff - 868a92f11bd0ef4ea994e8873914768cb7e89efe^2.. ...
-1396,7 +1396,7 @@ private int computeGravity() { int gravity = Gravity. ... this flag, - the global variable optimization pass of LLVM tries...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
This fix was more about arbitrary code execution rather than an exception free run. I think
1/0
should raise an exception.I would be ok to accept a callable if needed.