1.. _security-warnings: 2 3.. index:: single: security considerations 4 5Security Considerations 6======================= 7 8The following modules have specific security considerations: 9 10* :mod:`base64`: :ref:`base64 security considerations <base64-security>` in 11 :rfc:`4648` 12* :mod:`hashlib`: :ref:`all constructors take a "usedforsecurity" keyword-only 13 argument disabling known insecure and blocked algorithms 14 <hashlib-usedforsecurity>` 15* :mod:`http.server` is not suitable for production use, only implementing 16 basic security checks. See the :ref:`security considerations <http.server-security>`. 17* :mod:`logging`: :ref:`Logging configuration uses eval() 18 <logging-eval-security>` 19* :mod:`multiprocessing`: :ref:`Connection.recv() uses pickle 20 <multiprocessing-recv-pickle-security>` 21* :mod:`pickle`: :ref:`Restricting globals in pickle <pickle-restrict>` 22* :mod:`random` shouldn't be used for security purposes, use :mod:`secrets` 23 instead 24* :mod:`shelve`: :ref:`shelve is based on pickle and thus unsuitable for 25 dealing with untrusted sources <shelve-security>` 26* :mod:`ssl`: :ref:`SSL/TLS security considerations <ssl-security>` 27* :mod:`subprocess`: :ref:`Subprocess security considerations 28 <subprocess-security>` 29* :mod:`tempfile`: :ref:`mktemp is deprecated due to vulnerability to race 30 conditions <tempfile-mktemp-deprecated>` 31* :mod:`xml`: :ref:`XML vulnerabilities <xml-vulnerabilities>` 32* :mod:`zipfile`: :ref:`maliciously prepared .zip files can cause disk volume 33 exhaustion <zipfile-resources-limitations>` 34 35The :option:`-I` command line option can be used to run Python in isolated 36mode. When it cannot be used, the :option:`-P` option or the 37:envvar:`PYTHONSAFEPATH` environment variable can be used to not prepend a 38potentially unsafe path to :data:`sys.path` such as the current directory, the 39script's directory or an empty string. 40