Opening Chat
Hello, friends. Today we're going to discuss a very important topic: Python security programming. You might say: "Hey, I'm just writing some small scripts, who would want to attack me?" Don't think that way. In this interconnected era, any small security vulnerability can be exploited by hackers, leading to unexpected consequences.
Recently, I encountered an interesting case. A student created a simple website backend to manage student grades. The code looked simple, but shortly after going live, the entire database was wiped clean. The reason was inadequate SQL injection protection. This made me realize that security programming is a crucial topic that every Python developer must take seriously.
Injection Attacks
Speaking of injection attacks, they're like uninvited guests entering your home. You open the door for friends, but accidentally let bad actors slip in. In the programming world, the most common injection attacks are SQL injection and command injection.
SQL Protection
Remember the student grade management system I mentioned? Let's look at how the code was originally written:
user_input = input("Enter your username: ")
query = "SELECT * FROM users WHERE username = '" + user_input + "'"
result = cursor.execute(query)
This code looks simple, right? But it contains a fatal vulnerability. If a mischievous user inputs: ' OR '1'='1, the final SQL statement becomes:
SELECT * FROM users WHERE username = '' OR '1'='1'
This statement will retrieve all data from the table because '1'='1' is always true. This is the most basic SQL injection attack.
So how do we improve it? Let's look at the secure way:
user_input = input("Enter your username: ")
query = "SELECT * FROM users WHERE username = %s"
result = cursor.execute(query, (user_input,))
This code uses parameterized queries. It's like setting up a strict checkpoint for the database, where all parameters must pass security checks. The database driver automatically handles parameter escaping, leaving no room for hackers' injection attempts.
Command Injection
Let's talk about command injection. Sometimes we need to execute system commands in Python, like reading file contents. You might write something like this:
user_input = input("Enter the filename: ")
command = "cat " + user_input
os.system(command)
The problem with this code is that if a user inputs secret.txt; rm -rf /, the system will first display the contents of secret.txt, then delete all files in the root directory. It's like asking a waiter to bring you coffee, but they not only bring the coffee but also steal your wallet.
The secure approach is to use the subprocess module:
user_input = input("Enter the filename: ")
command = ["cat", user_input]
subprocess.run(command, check=True)
The advantage of this approach is that command is passed as a list, with each argument being independent and not interpreted by the shell. It's like putting a protective shield around each command, leaving no opportunity for hackers.
Comprehensive Protection
After discussing specific injection attack prevention, let's talk about more comprehensive security measures. It's like installing a complete security system for your house, not just having a security door, but also surveillance cameras and alarms.
Version Updates
First, you should regularly update your Python version and dependency packages. I've seen many projects compromised due to outdated packages. For example, a few months ago, a project using an old version of the requests library was exploited due to an SSL certificate verification vulnerability.
You can easily check and update packages using pip commands:
import pkg_resources
from subprocess import call
packages = [dist.project_name for dist in pkg_resources.working_set]
call("pip install --upgrade " + ' '.join(packages), shell=True)
This code automatically updates all installed packages. However, note that you should test compatibility with your code before updating.
Logging
Second, implement proper logging. It's like installing a dashcam for your program, recording all important operations:
import logging
logging.basicConfig(
filename='app.log',
level=logging.INFO,
format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'
)
def log_user_action(user, action):
logging.info(f'User {user} performed {action}')
try:
# Some potentially risky operations
result = dangerous_operation()
log_user_action('admin', 'performed dangerous operation')
except Exception as e:
logging.error(f'Operation failed: {str(e)}')
This code sets up basic logging, including time, log level, and specific information. When exceptions occur, it records detailed error information to help you track down the source of problems.
Sensitive Data
Finally, let's discuss handling sensitive data. This might be the most important part. I've seen too many projects hardcoding passwords and API keys directly in the code, which is essentially sending an invitation to hackers.
Let's look at how to properly handle passwords:
import hashlib
import os
def hash_password(password):
# Generate random salt
salt = os.urandom(32)
# Use SHA-256 for hashing
key = hashlib.pbkdf2_hmac(
'sha256',
password.encode('utf-8'),
salt,
100000
)
return salt + key
def verify_password(stored_password, provided_password):
salt = stored_password[:32]
stored_key = stored_password[32:]
# Verify password using the same salt and hash function
key = hashlib.pbkdf2_hmac(
'sha256',
provided_password.encode('utf-8'),
salt,
100000
)
return key == stored_key
This code uses the PBKDF2 algorithm and random salt for password hashing. It's like putting a bulletproof vest on the password - even if hackers get the database, they can't easily crack the original passwords.
Practical Example
After discussing so much theory, let's look at a complete practical example. Suppose we're developing a simple user authentication system:
import logging
import hashlib
import os
from datetime import datetime
from typing import Optional
class UserAuth:
def __init__(self, db_connection):
self.db = db_connection
self.setup_logging()
def setup_logging(self):
logging.basicConfig(
filename=f'auth_{datetime.now().strftime("%Y%m%d")}.log',
level=logging.INFO,
format='%(asctime)s - %(levelname)s - %(message)s'
)
def create_user(self, username: str, password: str) -> bool:
try:
if self._user_exists(username):
logging.warning(f"Attempt to create duplicate user: {username}")
return False
salt = os.urandom(32)
hashed_password = self._hash_password(password, salt)
query = "INSERT INTO users (username, password_hash, salt) VALUES (%s, %s, %s)"
self.db.execute(query, (username, hashed_password, salt))
self.db.commit()
logging.info(f"Created new user: {username}")
return True
except Exception as e:
logging.error(f"Error creating user {username}: {str(e)}")
return False
def authenticate(self, username: str, password: str) -> bool:
try:
query = "SELECT password_hash, salt FROM users WHERE username = %s"
self.db.execute(query, (username,))
result = self.db.fetchone()
if not result:
logging.warning(f"Failed login attempt for non-existent user: {username}")
return False
stored_hash, salt = result
if self._verify_password(password, stored_hash, salt):
logging.info(f"Successful login: {username}")
return True
else:
logging.warning(f"Failed login attempt for user: {username}")
return False
except Exception as e:
logging.error(f"Error during authentication for {username}: {str(e)}")
return False
def _user_exists(self, username: str) -> bool:
query = "SELECT 1 FROM users WHERE username = %s"
self.db.execute(query, (username,))
return bool(self.db.fetchone())
def _hash_password(self, password: str, salt: bytes) -> bytes:
return hashlib.pbkdf2_hmac(
'sha256',
password.encode('utf-8'),
salt,
100000
)
def _verify_password(self, password: str, stored_hash: bytes, salt: bytes) -> bool:
return self._hash_password(password, salt) == stored_hash
This implementation includes all the security features we discussed earlier: parameterized queries to prevent SQL injection, password hash storage, comprehensive logging, and exception handling. It's like a well-equipped security system where every component is carefully designed.
Conclusion
Security programming ultimately comes down to maintaining constant vigilance and never trusting user input. As I often tell my students: programming is like designing a castle - you not only want it to look beautiful but also want it to withstand various attacks.
Remember, security isn't a feature that can be added later; it should be a core consideration from the initial design. What do you think? Feel free to share your thoughts and experiences in the comments.
In the next article, we'll dive deep into implementing encryption algorithms in Python. If you're interested in this topic, remember to follow my blog. Let's write more secure and reliable code together in this challenging programming world.
Previous 
