Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This project allows Python code to extend built-in types.
If that's a good idea or not, you tell me. The first need this project attended was allowing a Python assertion library to implement a similar API to RSpec Expectations and should.js. But people got creative and used it to among other things spy on things or to integrate profiling.
It basically allows you to patch built-in objects, declared in C through python. Just like this:
int
class:from forbiddenfruit import curse
def words_of_wisdom(self):
return self * "blah "
curse(int, "words_of_wisdom", words_of_wisdom)
assert (2).words_of_wisdom() == "blah blah "
classmethod
to the str
class:from forbiddenfruit import curse
def hello(self):
return "blah"
curse(str, "hello", classmethod(hello))
assert str.hello() == "blah"
If you want to free your object from a curse, you can use the reverse()
function. Just like this:
from forbiddenfruit import curse, reverse
curse(str, "test", "blah")
assert 'test' in dir(str)
# Time to reverse the curse
reverse(str, "test")
assert 'test' not in dir(str)
Beware: reverse()
only deletes attributes. If you curse()
'd to replace
a pre-existing attribute, reverse()
won't re-install the existing attribute.
cursed()
acts as a context manager to make a curse()
, and then reverse()
it on exit. It uses
contextlib.contextmanager()
,
so on Python 3.2+ it can also be used as a function decorator. Like so:
from forbiddenfruit import cursed
with cursed(str, "test", "blah"):
assert str.test == "blah"
assert "test" not in dir(str)
@cursed(str, "test", "blah")
def function():
assert str.test == "blah"
function()
assert "test" not in dir(str)
Forbbiden Fruit is tested on CPython 2.7, 3.0, and 3.3-3.7.
Since Forbidden Fruit is fundamentally dependent on the C API, this library won't work on other python implementations, such as Jython, pypy, etc.
Copyright (C) 2013,2019 Lincoln Clarete lincoln@clarete.li
This software is available under two different licenses at your choice:
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Kimberly Chandler, from The Noun Project
FAQs
Patch python built-in objects
We found that forbiddenfruit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.