Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A zero-copy file-like wrapper for byte buffers, inspired by Rust's std::io::Cursor.
io‸cursor
A zero-copy
file-like wrapper
for Python byte buffers,
inspired by Rust's std::io::Cursor
.
iocursor.Cursor
lets you wrap an allocated buffer (i.e. a Python object
implementing the buffer protocol),
and interfacing with it through the API of a file-like object. It shares
some common points with io.BytesIO
but with the following main differences:
Cursor
will not copy the data you give it at
initialisation, while BytesIO
will. This makes Cursor
more efficient
when you are using it for read-only operations.Cursor
will only use the buffer you give it at
static memory, while BytesIO
will use its dedicated, growable buffer.Install directly from PyPI, using pip:
$ pip install iocursor
Pre-built wheels are available on Linux and OSX for all supported Python3 versions. Otherwise, building from source only requires a working C compiler.
iocursor.Cursor
instances are not thread-safe. Using several Cursor
instances with the same backend memory only for reading should be fine.
Use a lock when interfacing otherwise.
iocursor.Cursor
when you have bytes
you need to pass to an interface
that only accepts file-like objects. For instance, pass a PNG image decoded
from base64 to PIL, without copy:
import base64
from iocursor import Cursor
from PIL import Image
imgdata = base64.b64decode("iVBORw0KGgoAAAANSUhEU...")
img = Image.open(Cursor(imgdata))
iocursor.Cursor
when you want to use the file-like API to write
to a buffer of known size. For instance, retrieve a file using the
pysmb
API, which only accepts
file-like objects:
from SMB.SMBConnection import SMBConnectSMBConnection
smb = SMBConnection('guest', '', 'client', 'server')
smb.connect("192.168.0.1")
info = smb.getAttributes("Music", "The Clash/Rock the Casbah.mp3")
cursor = Cursor(bytearray(shared_file.file_size))
smb.retrieveFile("Music", "The Clash/Rock the Casbah.mp3", cursor)
buffer = cursor.getvalue()
iocursor.Cursor
when you want to do direct I/O on a type implementing
the buffer protocol. For instance, initialize a numpy
array by writing bytes
to it:
import numpy
array = numpy.empty(4, dtype="int16")
cursor = Cursor(array)
cursor.write(b"\x01\x00\x02\x00\x03\x00\x04\x00")
print(array) # array([1, 2, 3, 4], dtype=int16)
Found a bug ? Have an enhancement request ? Head over to the GitHub issue tracker if you need to report or ask something. If you are filing in on a bug, please include as much information as you can about the issue, and try to recreate the same bug in a simple, easily reproducible situation.
Contributions are more than welcome! See CONTRIBUTING.md
for more details.
This library is provided under the MIT License.
FAQs
A zero-copy file-like wrapper for byte buffers, inspired by Rust's std::io::Cursor.
We found that iocursor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.