RetroSearch Browse

Wed Jun 28 12:44:31 CEST 2006 · https://mail.python.org/pipermail/python-dev/2006-June/066674.html

Hi Brett,

On Tue, Jun 27, 2006 at 10:32:08AM -0700, Brett Cannon wrote:
> OK, with you and Thomas both wanting to keep it I will let it be.  I just
> won't worry about fixing it myself during my interpreter hardening crusade.

I agree with this too.  If I remember correctly, you even mentioned in
your rexec docs that sys.setrecursionlimit() should be disallowed from
being run by untrusted code, which means that an untrusted interpreter
would be safe.

I guess we could add an example of a bogus 'new.code()' call in the
Lib/test/crashers directory too, without you having to worry about it in
untrusted mode if new.code() is forbidden.  I could also add my
'gc.get_referrers()' attack, which should similarly not be callable from
untrusted code anyway.

A bientot,

Armin

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://mail.python.org/pipermail/python-dev/2006-June/066674.html below:

[Python-Dev] Is Lib/test/crashers/recursive_call.py really a crasher?