All language subtitles for 007 Handling User Input_en

In the previous lecture, we learned how to allow the user to set variables using the input or zero

input function.

Now this is very useful and works perfectly as shown in that lecture.

The only problem with this is that the way we use the variable and here is not very secure.

Now, this might not be a problem when it comes to simple scripts like this, but I just want to give

you this note so that you keep it in mind whenever you're writing your own programs.

It's not very secure because we're allowing the user to input anything they want in here, and then

we're not checking what this input is.

So we're supposed to only allow the person to enter a name for the interface and a value for a new Mac.

But the user can misuse this program and enter Linux commands.

Then these commands are going to be substituted in here and the sub process dot called module and they'll

actually be executed on the system.

Now again, like I said, in this scenario of this program that we're writing right now, this might

not be a very big of an issue, but you can argue the fact that this program is not very secure or is

not very well implemented because it allows the user to use it to do other things than its purpose.

So let me show you what I'm talking about.

We all know if we do ls it's a list, all the files in the current directory.

And as you can see, I have my mac changer and VM directory.

Now let's run our Python script.

And then when it asks me for interface, I'm going to put zero, but I'm also going to put a semicolon

and put another command.

Now the second.

Now the semicolon in Linux is used to tell the terminal that I want to execute another command after

the current command.

So that's why I'm putting it here.

And then I'm going to put LS, which is my second command.

So what's going to happen now is the interface variable is going to have a value of zero semicolon L's

that's going to be substituted in here.

So this command is going to become if config line zero and of command because we have the semicolon

and then the next command is going to be RLS.

So I'm also going to put another semicolon after it to make sure that whatever that comes after this

command is going to be treated as another command.

And now when I hit enter, you'll see that we'll manage to hijack marked change or dot py, which is

our program and get it to execute other commands on the system that the program is not supposed to execute.

So we're just going to put anything for Mark.

So as you can see, the first command was if config land zero and this is its result.

And then it executed LZ, which is my second command.

And this is its result.

As you can see, it's listed in the files and the current working directory.

Now, this output is repeated three times because the interface is used three times in here in these

three lines.

So basically what's happening is a user can hijack our program and get it to execute other commands

that the program is not supposed to execute and the user is not supposed to be allowed to do these things

through our program.

And again, this might not be vital in this simple script that we're writing right now, but you want

to keep this in mind whenever you're writing your own programs.

Now, there is a very simple fix to this issue, and it can be implemented using the second way of calling

sub process.

So remember the first time I showed you the sub process module and I said that there is two ways of

using the call function.

We can use it using this way, which is the one that we've been using in all of the previous lectures.

Or you can use it using this way, which is a little bit confusing.

Hence I went with the second way to start up with you.

Now, if you think of it this way is actually kind of simple once you just analyze it.

So you still call in sub process, don't call.

And the only difference is, instead of giving the command as a string like this, you're splitting

the command in a number of elements inside a list.

So each element or each string in here is actually one word.

So every time you see a space in the command, you're supposed to close the quote, separate it with

a comma, and put the rest of the command.

The next time you hit a space, you close the quote, put a comma, and onto the next word.

When you do this, python will know that the first element in here is the command.

And everything that comes after it is arguments or is part of that command.

So even if we try to hijack it the same way that we just did, Python will know that this should be

part of the first command and should never be executed as a second command.

Let me put this in practice and it will become clearer to you.

So I'm actually going to retype the commands here below.

So we're doing sub process, dot call.

And then instead of giving a script, we're going to give a list.

So we're going to open a square bracket and close it.

And again, each element in here is going to be a string.

And every time we see a space, we're going to close the element.

So the command that we always use is usually if config.

Then we're not going to put a space.

We're going to go outside this string, put a comma space, and then type the next part, which is our

interface, as you can see here.

Now, because the interface is a variable, we don't need to enclose it in two quotation marks, so

we're just going to type that the way it is.

Then the next argument of the if config command is down.

And again, we're enclosing this with two quotation marks because down is a string, it's part of the

command.

So if you compare this with that, it's actually very similar.

The only difference is, instead of adding everything in a string, we have a list in which each element

is a word in that command.

So every time we see a space, we put it as a separate element.

Now, this is actually the first time you see a list, and it's a very good example.

As you can see, a list is just a number of elements that we enclose within two square brackets, this

bracket and this bracket.

Now we're going to have to do the same with the next two commands.

So to to duplicate the current line, I'm just going to do control the twice.

As you can see, it's doing it for me automatically and now I just need to do the second command.

So the second command is already if config interface.

Now this shouldn't be done, this should be set to h w and put a comma and the next word is either put

a comma and finally we put the new Mac again.

We don't need to enclose this in quotation marks because it's a variable.

And finally, the last command is going to be if config interface up instead of down and that's it.

So these three commands are a much more secure version of these three commands.

It's more secure because now Python knows that the interface and down are all part of the same command,

which is if config.

So even if I try to hijack the interface variable and put a command in here, Python will know that

this should not be treated as a command and it will try to execute it within the if config command here.

This will return an error, but it won't allow an attacker to hijack the flow of our program.

Now let's delete all of this.

Save and test our program.

So I'm going to clear all of this and we have our program here.

It's asking me for the interface and I'm going to do one zero and follow it by LZ.

Like we did before.

I'm going to hit Enter, put anything for Mark.

And as you can see, it's complaining about the existence of the code and the LZ, and then it's complaining

about the interface name, but it's not executing the list on the system.

So a person cannot use this program to do anything other that we want them to do.

Now let's test the program and make sure that it actually works.

So we set the interface to zero and put a new mark.

And I'm just going to do three, three, three, three this time.

We got the right message.

Let's do if config land zero.

And as you can see, the MAC address is changed properly to one one, two, two, three, three, three,

three, three, three.

And the program is working as expected.