{"id":2012,"date":"2020-05-18T10:28:00","date_gmt":"2020-05-18T10:28:00","guid":{"rendered":"https:\/\/www.securecoding.com\/?p=2012"},"modified":"2020-10-15T09:14:06","modified_gmt":"2020-10-15T09:14:06","slug":"python-security-practices-you-should-maintain","status":"publish","type":"post","link":"https:\/\/www.securecoding.com\/blog\/python-security-practices-you-should-maintain\/","title":{"rendered":"Python Security Practices You Should Maintain"},"content":{"rendered":"\n

<\/p>\n\n\n

\n\t
\n\t\t\t\n\t\n\t\t\"\"\n<\/picture>\n\t\t<\/div>\n<\/section>\n\n\n
\n\t
\n\t\t
\n\t\t

Python is a high-level programming language and offers a lot of flexibility and liberty to structure your codebase the way you want it which might open up some loopholes if security practices are not being followed.<\/span><\/p>\n

 <\/p>\n

When building software, writing secure code is essential for protecting sensitive data and maintaining correct behaviour of software. Writing secure code can be hard though and even the best developers can\u2019t always be 100% sure of the security of their code.\u00a0<\/span><\/p>\n

 <\/p>\n

No matter how small the application and or how good the developers who built it are, there\u2019s always a possibility of a security vulnerability that could be exploited to steal money from users or be the next known Cyber-Incident.<\/span><\/p>\n

 <\/p>\n

So what do you do to prevent or avoid this?<\/span><\/p>\n

 <\/p>\n

The best thing to do here is to follow best practices for writing secure code when building applications using Python. In this article, we\u2019ll explore best practices for securing python code from the simplest practices to the hardest one.<\/span><\/p>\n

 <\/p>\n

Use the Most Recent Major Version of Python<\/b><\/h2>\n

 <\/p>\n

Many companies and developers are still running old versions of Python for their projects and even in production like Python 2.6 or 2.7. These are way outdated and won\u2019t receive any more<\/span> security updates after April 2020<\/span><\/a>.\u00a0<\/span><\/p>\n

 <\/p>\n

Python 3 was released date back in 2008 and starting from Jan 1, 2020 the Python Foundation announced that Python 2 will stop receiving security updates or support from the community.<\/span><\/p>\n

 <\/p>\n

If you are still using old versions of Python below Python 3, then you should start considering how to migrate your codebase to Python 3. Start using Python 3 for your new projects or you leave yourself open to security vulnerabilities.\u00a0\u00a0<\/span><\/p>\n

 <\/p>\n

To check for your Python version, you can run:<\/span><\/p>\n

 <\/p>\n

python –version<\/span><\/p>\n

 <\/p>\n

Migrating your Python 2 code to Python 3 is actually very easy and you can read more on how to do that<\/span> here<\/span><\/a>.<\/span><\/p>\n

 <\/p>\n

Use a Virtual Environment\u00a0<\/b><\/h2>\n

 <\/p>\n

When building any Python projects, it’s always advisable to use a virtual environment as it helps to prevent conflict in Python modules and as well as have the same modules both on local and production environments.\u00a0<\/span><\/p>\n

 <\/p>\n

Using a virtual environment prevents having malicious Python dependencies in your projects and shipping the same to production by using `pip freeze` to generate requirements.txt. If you have malicious packages in your Python environments, using a virtual environment will prevent having the same packages in your Python codebase since it’s isolated.<\/span><\/p>\n

 <\/p>\n

To create a virtual environment you can either use<\/span> Virtualenv<\/span><\/a> or<\/span> Pipenv<\/span><\/a> which help create isolated virtual environments. Pipenv helps to manage, have a predictable and up-to-date environment.\u00a0<\/span><\/p>\n

With Pipenv, you can manage your installations, virtual environments, look through your dependency tree, and scan your dependencies for known vulnerabilities.<\/span><\/p>\n

 <\/p>\n

You can set up Virtualenv:<\/span><\/p>\n

 <\/p>\n

pip install virtualenv<\/span><\/p>\n

virtualenv -p \/path\/to\/python <env_name><\/span><\/p>\n

 <\/p>\n

Import Packages the Right Way<\/b><\/h2>\n

 <\/p>\n

When working with external or internal Python modules, you should always ensure you are importing them the right way and using the right paths. We have two types of import paths in Python and they are absolute, relative.<\/span><\/p>\n

 <\/p>\n

Absolute imports specifies the path of the resource to be imported using its full path from the project\u2019s root folder while relative import specifies the resource to be imported relative to the current location of the project where the import statement is.<\/span><\/p>\n

 <\/p>\n