Search icon CANCEL
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Learn Web Development with Python

You're reading from   Learn Web Development with Python Get hands-on with Python Programming and Django web development

Arrow left icon
Product type Course
Published in Dec 2018
Publisher
ISBN-13 9781789953299
Length 796 pages
Edition 1st Edition
Languages
Tools
Arrow right icon
Authors (3):
Arrow left icon
Fabrizio Romano Fabrizio Romano
Author Profile Icon Fabrizio Romano
Fabrizio Romano
Gaston C. Hillar Gaston C. Hillar
Author Profile Icon Gaston C. Hillar
Gaston C. Hillar
Arun Ravindran Arun Ravindran
Author Profile Icon Arun Ravindran
Arun Ravindran
Arrow right icon
View More author details
Toc

Table of Contents (33) Chapters Close

Title Page
About Packt
Contributors
Preface
1. A Gentle Introduction to Python FREE CHAPTER 2. Built-in Data Types 3. Iterating and Making Decisions 4. Functions, the Building Blocks of Code 5. Saving Time and Memory 6. OOP, Decorators, and Iterators 7. Files and Data Persistence 8. Testing, Profiling, and Dealing with Exceptions 9. Concurrent Execution 10. Debugging and Troubleshooting 11. Installing the Required Software and Tools 12. Working with Models, Migrations, Serialization, and Deserialization 13. Creating API Views 14. Using Generalized Behavior from the APIView Class 15. Understanding and Customizing the Browsable API Feature 16. Using Constraints, Filtering, Searching, Ordering, and Pagination 17. Securing the API with Authentication and Permissions 18. Applying Throttling Rules and Versioning Management 19. Automating Tests 20. Solutions 21. Templates 22. Admin Interface 23. Forms 24. Security 25. Working Asynchronously 26. Creating APIs 27. Production-Ready 1. Other Books You May Enjoy Index

Shell injection


As the name suggests, shell injection or command injection allows an attacker to inject malicious code into a system shell such as bash. Even web applications use command-line programs for convenience and their functionality. Such processes are typically run within a shell.

For example, if you want to show all the details of a file whose name is given by the user, a naïve implementation would be as follows:

os.system("ls -l {}".format(filename)) 

An attacker can enter the filename as manage.py; rm -rf * and delete all the files in your directory. In general, it is not advisable to use os.system. The subprocess module is a safer alternative (or even better, you can use os.stat() to get the file's attributes).

Since a shell will interpret the command-line arguments and environment variables, setting malicious values in them can allow the attacker to execute arbitrary system commands.

How Django helps

Django primarily depends on WSGI for deployment. Since WSGI, unlike CGI, does not...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime