Comments (7)
Thanks for raising this, I looked at the pyforce PR, which seems straightforward enough but adds additional dependencies, something beatbox was trying to avoid. Typically the sax handler can disable this, i'll have a poke around.
from beatbox.
It is interesting that the external package defusexml
is one of two safe alternatives recommended in Python docs about XML. I think that Salesforce is more trustworthy for its customers than any trustworthy external package, e.g. by hijackinging that additional site.
Internal ElementTree package would be safe against data leak. The remaining "billion laughs" or "quadratic blowup" DDoS attacks are improbable by a response from Salesforce. Salesforce has so many easier legal ways to directly refuse a service that a DDoS attack by XML is a nonsense.
from beatbox.
There are a few different things here:
If you're concerned with the extra attack surface of an external package getting updated with malicious code in the future then you can just lock it to ==0.5.0 -- I think that's the latest and I did read it all. (Or just inline the relevant code, although I don't remember if it has xmlsec etc. as a dependency.)
If you're concerned with PyPi getting hacked you should have internal mirrors and audit everything when you update.
When I say Salesforce I'm not talking about the brand name or company ethos, I have nothing against them [1], it's more that if they have a disgruntled employee or are compromised. If I was on their security team I wouldn't want this library being vulnerable, as it potentially makes things worse in the event of an incident.
Is potential RCE (by using sax) an acceptable risk, given the pretty low likelihood? No.
Is DoS (not DDoS), by using ElementTree, an acceptable risk, given the pretty low likelihood? I might say Yes, you say Yes, but do we want to decide for everyone using the library? I don't know, I fixed my fork with defusedxml and don't really know what to say.
[1] one small thing
from beatbox.
Sure thing, I'll have a look at whatever you come up with without defusedxml.
from beatbox.
ElementTree doesn't export make_parser though, and I've never seen anyone else use sax, so there is probably a legitimate reason why you can't replace it with ElementTree easily.
from beatbox.
Sax module in current Python versions >= 3.6.7, >= 3.7.1, >= 3.8.0 is safe against RCE attacks by xml (external entity expansion attack and DTD retrieval). In other words: all Python versions >= 3.6 with a security fix from October 2018 or later are safe.
The official end of life of Python 2.7 was on 1th January 2020. The end of life of 3.5 is on 13th September 2020.
If Salesforce is used as a storage of important private economic data then providing no data by Salesforce would an effective form of Denial of Service that can't be prevented. Providing invalid economic data by Salesforce (or someone who can falsify a TLS certificate of SFDC) would be even worse than a DoS.
from beatbox.
That's a great point about Python 2, I'm okay with closing this 👍
from beatbox.
Related Issues (20)
- init of beatbox.Client() HOT 1
- Query Time Out HOT 3
- Review TLS support
- can't select fields which contains the word 'Address' HOT 1
- support in setting the batchSize of the service HOT 1
- How to pull the data from method describeGlobal() HOT 1
- OS X El Capitan and TLS 1.0 error after updating openssl HOT 2
- retrieve method fails if only one record found HOT 4
- add retrieve to IterClient
- Add unit tests HOT 6
- do we still need the manifest file? HOT 3
- Any new release / pypi release scheduled for Beatbox? HOT 17
- QUERY_TIMEOUT: Your query request was running for too long HOT 4
- gzipRequest not working for python3 HOT 2
- Salesforce Refresh Instances HOT 6
- Will beatbox support uploads to sfdc Files? HOT 1
- Python 3.6.7 - wrong output HOT 3
- No longer outputting json like legacy 2.7 version HOT 2
- Getting more results than 500 HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from beatbox.