Re: Marshal Obj is String or Binary?

"Giovanni Bajo" <noway@xxxxxxxxx> writes:
> casevh@xxxxxxxxxxx wrote:
>> Try...
>>>>> for i in bytes: print ord(i)
>> or
>>>>> len(bytes)
>> What you see isn't always what you have. Your database is capable of
>> storing \ x 0 0 characters, but your string contains a single byte of
>> value zero. When Python displays the string representation to you, it
>> escapes the values so they can be displayed.
> He can still store the repr of the string into the database, and then
> reconstruct it with eval:

repr and eval are overkill for this, and as as result create a
security hole. Using encode('string-escape') and
decode('string-escape') will do the same job without the security
hole:

>>> bytes = '\x00\x01\x02'
>>> bytes
'\x00\x01\x02'
>>> ord(bytes[0])
0
>>> rb = bytes.encode('string-escape')
>>> rb
'\\x00\\x01\\x02'
>>> len(rb)
12
>>> rb[0]
'\\'
>>> bytes2 = rb.decode('string-escape')
>>> bytes == bytes2
True
>>>

<mike
--
Mike Meyer <mwm@xxxxxxxxx> http://www.mired.org/home/mwm/
Independent WWW/Perforce/FreeBSD/Unix consultant, email for more information.
.

Relevant Pages

  • Re: use of application roles
    ... > creating a security hole because of the hardcoded username ... > the database. ... permissions need only be granted to the app role. ... SQL Server MVP ...
    (microsoft.public.sqlserver.security)
  • Re: cpython list __str__ method for floats
    ... str doesn't "return" repr. ... and the closing square bracket. ...
    (comp.lang.python)
  • use of application roles
    ... to let my users enter data via a custom application, ... creating a security hole because of the hardcoded username ... Do the users need any rights to the database ...
    (microsoft.public.sqlserver.security)
  • RE: big problem!!!!!
    ... Potential security hole? ... Move the database to a directory your app has access to. ... highly conducive to web service serving of data ... > we use this ODBC connectionstring: ...
    (microsoft.public.dotnet.framework.adonet)
  • Re: eval(repr(object)) hardly ever works
    ... string representation that can then be eval'd back to life, ... an object with a simple repr() which is code ... to create an identical object is easy to use as a key in a dictionary. ...
    (comp.lang.python)