Comments on: Blender 2.42 Security Advisory http://www.blendernation.com/blender-242-security-advisory/ Fresh Blender News, Every Day Sun, 22 Nov 2009 01:06:38 +0100 http://wordpress.org/?v=2.8.6 hourly 1 By: Bart http://www.blendernation.com/blender-242-security-advisory/comment-page-1/#comment-98182 Bart Thu, 03 May 2007 05:20:11 +0000 http://www.blendernation.com/2007/04/24/blender-242-security-advisory/#comment-98182 I guess it would. But why not run Blender in a sandbox by default, unless you need a script which you *know* will need filesystem or network access and which you trust? That would bring us back to Joeri's suggestion of including options to disable such access and turn them on by default - I really like that idea. I guess it would. But why not run Blender in a sandbox by default, unless you need a script which you *know* will need filesystem or network access and which you trust? That would bring us back to Joeri's suggestion of including options to disable such access and turn them on by default – I really like that idea.

]]> By: Kernon http://www.blendernation.com/blender-242-security-advisory/comment-page-1/#comment-97730 Kernon Tue, 01 May 2007 22:05:18 +0000 http://www.blendernation.com/2007/04/24/blender-242-security-advisory/#comment-97730 I wonder if simply running Blender in a "sandbox", when testing unknown scripts, would be a surefire way to eliminate any potential threats? Could the solution be that simple? There's a free utility called Sandboxie that could easily do this, if this would be a good solution. I wonder if simply running Blender in a "sandbox", when testing unknown scripts, would be a surefire way to eliminate any potential threats? Could the solution be that simple? There's a free utility called Sandboxie that could easily do this, if this would be a good solution.

]]> By: Joeri http://www.blendernation.com/blender-242-security-advisory/comment-page-1/#comment-95949 Joeri Sat, 28 Apr 2007 09:39:51 +0000 http://www.blendernation.com/2007/04/24/blender-242-security-advisory/#comment-95949 I think there are several levels of security, each with their own risk. Downloading and running a game will always be a risk, blender used or not. But if downloading and using a model can start being a risk ( because of poor programming ) then that's a bridge to far. I think there are several levels of security, each with their own risk.
Downloading and running a game will always be a risk, blender used or not.
But if downloading and using a model can start being a risk ( because of poor programming ) then that's a bridge to far.

]]> By: blendenzo http://www.blendernation.com/blender-242-security-advisory/comment-page-1/#comment-95675 blendenzo Fri, 27 Apr 2007 23:45:22 +0000 http://www.blendernation.com/2007/04/24/blender-242-security-advisory/#comment-95675 Joeri, I agree with you that it is difficult to communicate how to avoid these issues to most people. I use Blender mainly as a game programmer, and I'm fluent in Python, but I still have trouble reading other people's scripts sometimes. Beyond that, there could be security issues other than eval() and exec() that we haven't considered. What about Python's socket capabilities, or functions which execute commands in the web browser? To be honest, I don't have a real solution to the problem. I need execv() in my games in order to set up display options menus that will run the blenderPlayer on the game file with appropriate flags. If the exec() functions were disabled by default (and especially if they were take out of Blender completely), then my games would not function properly in other people's Blenders. And what about the issue of the blenderPlayer? Should the functions be disabled there as well? And how will you protect someones computer when they have a full Python installation with a Python Path specified? Even if Blender disabled the functions in its Python package, the script would revert to the standard Python installation and wreak its havoc. (BTW, not everyone with Python Path specified is a Python Guru. Some people do it just to be able to use special scripts, like Ter2Blend for example.) Like I've said, anything that you download can be hazardous to your computer, and sometimes there just isn't much knowing ahead of time. I don't know if there is a real solution to this issue, but I think that the warnings system is perhaps a good start. Joeri, I agree with you that it is difficult to communicate how to avoid these issues to most people. I use Blender mainly as a game programmer, and I'm fluent in Python, but I still have trouble reading other people's scripts sometimes. Beyond that, there could be security issues other than eval() and exec() that we haven't considered. What about Python's socket capabilities, or functions which execute commands in the web browser?

To be honest, I don't have a real solution to the problem. I need execv() in my games in order to set up display options menus that will run the blenderPlayer on the game file with appropriate flags. If the exec() functions were disabled by default (and especially if they were take out of Blender completely), then my games would not function properly in other people's Blenders. And what about the issue of the blenderPlayer? Should the functions be disabled there as well? And how will you protect someones computer when they have a full Python installation with a Python Path specified? Even if Blender disabled the functions in its Python package, the script would revert to the standard Python installation and wreak its havoc. (BTW, not everyone with Python Path specified is a Python Guru. Some people do it just to be able to use special scripts, like Ter2Blend for example.)

Like I've said, anything that you download can be hazardous to your computer, and sometimes there just isn't much knowing ahead of time. I don't know if there is a real solution to this issue, but I think that the warnings system is perhaps a good start.

]]> By: Joeri http://www.blendernation.com/blender-242-security-advisory/comment-page-1/#comment-94567 Joeri Thu, 26 Apr 2007 07:33:49 +0000 http://www.blendernation.com/2007/04/24/blender-242-security-advisory/#comment-94567 "Note how easy it is for me to say what other people could do, being someone who's never coded a line of Blender code in his life" I don't think that stating an idea on how to solve an issue is the same as telling people that they should be doing something for you... Of course if nobody picks it up then we can always point to this article. This will probably only gets solved after a large user group has been attacked and lost lots of data... That's how these things work in my experience. It's not an easy task to communicate to people who don't know how to check for harmfull elements how to check for harmfull elements. Just stating: "This script contains an eval() that might harm your data somewhere in the future" might not cut the cake. Another option could be to have a security tab in the info/user settings window. With toggles "Blender: No automatic script execution (scriptlink)", "Python: No exec", "Python: No eval()", "Macro: No delete", "Macro: No save". Etc, all active by default :) "Note how easy it is for me to say what other people could do, being someone who's never coded a line of Blender code in his life"

I don't think that stating an idea on how to solve an issue is the same as telling people that they should be doing something for you… Of course if nobody picks it up then we can always point to this article.
This will probably only gets solved after a large user group has been attacked and lost lots of data…
That's how these things work in my experience.

It's not an easy task to communicate to people who don't know how to check for harmfull elements how to check for harmfull elements. Just stating: "This script contains an eval() that might harm your data somewhere in the future" might not cut the cake.
Another option could be to have a security tab in the info/user settings window. With toggles "Blender: No automatic script execution (scriptlink)", "Python: No exec", "Python: No eval()", "Macro: No delete", "Macro: No save". Etc, all active by default :)

]]> By: Bart http://www.blendernation.com/blender-242-security-advisory/comment-page-1/#comment-94348 Bart Wed, 25 Apr 2007 18:28:44 +0000 http://www.blendernation.com/2007/04/24/blender-242-security-advisory/#comment-94348 @Joeri: yes, but I suppose you COULD scan all the .py files that Blender tries to load and 'securify' potentially dangerous functions such as eval(). (Note how easy it is for me to say what other people could do, being someone who's never coded a line of Blender code in his life ;-) @Joeri: yes, but I suppose you COULD scan all the .py files that Blender tries to load and 'securify' potentially dangerous functions such as eval().

(Note how easy it is for me to say what other people could do, being someone who's never coded a line of Blender code in his life ;-)

]]> By: Joeri http://www.blendernation.com/blender-242-security-advisory/comment-page-1/#comment-94313 Joeri Wed, 25 Apr 2007 17:01:44 +0000 http://www.blendernation.com/2007/04/24/blender-242-security-advisory/#comment-94313 "If anything is found, a simple dialog is displayed" Although I total agree with you I think in this case this is a bit more difficult. As I understand it the harm is done in the downloading of a (model) file. Because the language of model file is in xml it could contain instructions that can be "evaluated". Or did I get this wrong? ( Thats like loading an image on the psp that causes an overflow and installs a hack. ) It will be pretty hard for a user to figure out that the model he is trying to view/import is actualy installing harmfull software. "If anything is found, a simple dialog is displayed"
Although I total agree with you I think in this case this is a bit more difficult.
As I understand it the harm is done in the downloading of a (model) file.
Because the language of model file is in xml it could contain instructions that can be "evaluated".
Or did I get this wrong?

( Thats like loading an image on the psp that causes an overflow and installs a hack. )

It will be pretty hard for a user to figure out that the model he is trying to view/import is actualy installing harmfull software.

]]> By: Kernon http://www.blendernation.com/blender-242-security-advisory/comment-page-1/#comment-94217 Kernon Wed, 25 Apr 2007 13:06:28 +0000 http://www.blendernation.com/2007/04/24/blender-242-security-advisory/#comment-94217 Just to clarify my point, the filtering mechanism I mentioned would NOT have to analyze the script's code, that's ridiculous. It would only need to search for keywords like EVAL, EXEC, etc. If anything is found, a simple dialog is displayed with a textbox listing the line number and the potentially harmful keyword found on that line (options to print, save to text file). At that point it's up to the user to determine the validity of the code. If the user isn't qualified to analyze the validity of the code, then it would be in their best interest to only download from well-established and trusted sources that ensure their visitors that the files have been validated. This is a serious issue because the more capable that Blender becomes, the more toes it will begin to step on. And, because the door is truly wide open, it COULD become an easy target because of jealousy, envy, pranks, or those whose bottom line is being effected. Today's word is: proactive (Acting in advance to deal with an expected difficulty; anticipatory) Just to clarify my point, the filtering mechanism I mentioned would NOT have to analyze the script's code, that's ridiculous. It would only need to search for keywords like EVAL, EXEC, etc. If anything is found, a simple dialog is displayed with a textbox listing the line number and the potentially harmful keyword found on that line (options to print, save to text file). At that point it's up to the user to determine the validity of the code. If the user isn't qualified to analyze the validity of the code, then it would be in their best interest to only download from well-established and trusted sources that ensure their visitors that the files have been validated.

This is a serious issue because the more capable that Blender becomes, the more toes it will begin to step on. And, because the door is truly wide open, it COULD become an easy target because of jealousy, envy, pranks, or those whose bottom line is being effected.

Today's word is: proactive (Acting in advance to deal with an expected difficulty; anticipatory)

]]> By: Kernon http://www.blendernation.com/blender-242-security-advisory/comment-page-1/#comment-94170 Kernon Wed, 25 Apr 2007 11:24:07 +0000 http://www.blendernation.com/2007/04/24/blender-242-security-advisory/#comment-94170 @IamInnocent I would imagine that it's been known only by those that actively write python scripts, not by those who just use python scripts. I wasn't aware of it and got wind of it via a GoogleAlert. The article was written immediately. I think the best solution to these types of problems is to implement, in the Blender codebase, a filtering mechanism that simply scrubs a script's code before loading, alerting the user of any potentially harmful code...an anti-malware feature. I have something like this for Visual Basic and it works great. The potential for problems will only skyrocket when Blender gets macro capability. However, I'm sure the developers are on top of this issue. @IamInnocent
I would imagine that it's been known only by those that actively write python scripts, not by those who just use python scripts. I wasn't aware of it and got wind of it via a GoogleAlert. The article was written immediately.

I think the best solution to these types of problems is to implement, in the Blender codebase, a filtering mechanism that simply scrubs a script's code before loading, alerting the user of any potentially harmful code…an anti-malware feature. I have something like this for Visual Basic and it works great. The potential for problems will only skyrocket when Blender gets macro capability. However, I'm sure the developers are on top of this issue.

]]> By: Joeri http://www.blendernation.com/blender-242-security-advisory/comment-page-1/#comment-94092 Joeri Wed, 25 Apr 2007 08:07:45 +0000 http://www.blendernation.com/2007/04/24/blender-242-security-advisory/#comment-94092 The trouble with this issue is the user. Downloading things on your computer is as "safe" as the limits to your knowledge. It's not a real issue with "images" but gets more of an issue with "documents". Operating systems do their best not to help you in any way as to what kind of "document" you are downloading. Windows finds everything a possible risk, making it a useless warning. When documents are scripts things get serious. How is a user to know that some script contains a system.exec that downloads things to exec (or eval?). So I think exec and eval should be sandboxed or off by default, making some bad written scripts useless for the people who don't know the risks. This will become even more of an issue with the macros blender will be able to execute within a version or two. The trouble with this issue is the user.
Downloading things on your computer is as "safe" as the limits to your knowledge.

It's not a real issue with "images" but gets more of an issue with "documents".
Operating systems do their best not to help you in any way as to what kind of "document" you are downloading. Windows finds everything a possible risk, making it a useless warning.

When documents are scripts things get serious. How is a user to know that some script contains a system.exec that downloads things to exec (or eval?). So I think exec and eval should be sandboxed or off by default, making some bad written scripts useless for the people who don't know the risks.

This will become even more of an issue with the macros blender will be able to execute within a version or two.

]]>