security - Is it possible to inject shell/python commands from a configuration file? -

say have meta data custom file format python app reads. csv variables can change file manipulated:

var1,data1 var2,data2 var3,data3 

so if user can manipulate meta data, have worry crafting malformed meta data file allow arbitrary code execution? thing can imagine if you made poor choice make var1 shell command execute os.sys(data1) in own code somewhere. also, if c have worry buffers being blown, don't think have worry python. if reading in data string possible somehow escape string "\n os.sys('rm -r /'), sql example totally wont work, there similar possible?

if doing there (plain text, reading , parsing simple format), safe. indicate, python safe more mundane memory corruption errors c developers can create if not careful. sql injection scenario note not concern when reading in files in python.

however, if concerned security, seems (interjection: you! programmer should lazy and paranoid), here things consider:

validate input. make sure each piece of data read of expected size, type, range, etc. error early, , don't propagate tainted variables elsewhere in code.

• do know expected names of vars, or @ least format? make sure validate kind of thing expect before use it. if should letters, confirm regex or similar.
• do know expected range or format of data? if you're expecting number, make sure it's number before use it. if it's supposed short string, verify length; idea.
• what if characters or bytes don't expect? if throws unicode @ you?
• if of these paths, make sure canonicalize , know path points acceptable location before read or write.

some specific things not do:

• os.system(attackercontrolledstring)
• eval(attackercontrolledstring)
• __import__(attackercontrolledstring)
• pickle/unpickle attacker controlled content (here's why)

also, rather rolling own config file format, consider configparser or json. understood format (and libraries) helps leg on proper validation.

owasp normal go-to providing "further reading" link, input validation page needs help. in lieu, looks reasonably pragmatic read: "secure programmer: validating input". dated more python specific 1 "dealing user input in python"