使用时如何检查python模块是否正在发送数据？

Question

The title pretty much says it.
I need to make sure that while I am working with python modules there isn't any sort of malicious code in the module, specifacily the type that scrapes data from the machine runnign the code and sends it elsewhere?
do i have a method of doing that with python?
can i be certain this is done even when i am using modules like requests for sending and receiving HTTP GET\\POST requests?
I mean is there a way to check this without reading every line of code in module?

Answer 1

You question is not really connected to python it is more a security risk. Python is a dynamic language so checking if any module behaves correctly is near impossible. However, what you can do it setup a virtual machine sandbox run your program with some fake data and check if guest machine tries to make some strange connections. You can than inspect where data is being send in what format and then trace it back to malicious code fragment in one of the modules.

EDIT

The only other option is if you are sure what method/function the malicious code will use. If it is for example the request library you could patch for example the post() method to check the destination or the package that is being send. However the malicious code could use its own implementation so you cannot be 100% sure.

A link on how to patch post() method

How to unit test a POST method in python?

Answer 2

It's better to have a global approach using tools like Wireshark for example that lets you sniff the packets sent/received by your machine.

With that said, in python, you could overwrite some methods that you're suspicious about. Here's the idea

import requests


def write_to_logs(message):
    print(message)  # Or you could store in a log file

original_get = requests.get

def mocked_get(*args, **kwargs):
    write_to_logs('get method triggered with args = {}, kwargs= {}'.format(args,kwargs))
    original_get(*args, **kwargs)

requests.get = mocked_get

response = requests.get('http://google.com')

Output :

get method triggered with args = ('http://google.com',), kwargs= {}