Implement a Defensive Security System

I apologize in advance if this is too long. I am studying for a test in app-sec and I have a lab in python (RepyV2 - a python variation) which I need to work on. Unfortunately, I am new to programming. I have just gotten started with Python. Basically, you are presented with a piece of code (reference monitor), and you are required to modify it to prevent a user/attacker from making the code perform certain unauthorized actions. How do I start? I need help Here is the code of the reference monitor:



class ABFile():
  def __init__(self,filename,create):
    # globals
    mycontext['debug'] = False   
    # local (per object) reference to the underlying file
    self.Afn = filename+'.a'
    self.Bfn = filename+'.b'

    # make the files and add 'SE' to the readat file...
    if create:
      self.Afile = openfile(self.Afn,create)
      self.Bfile = openfile(self.Bfn,create)

  def writeat(self,data,offset):
    # Write the requested data to the B file using the sandbox's writeat call
  def readat(self,bytes,offset):
    # Read from the A file using the sandbox's readat...
    return self.Afile.readat(bytes,offset)

  def close(self):

def ABopenfile(filename, create):
  return ABFile(filename,create)

# The code here sets up type checking and variable hiding for you.  You
# should not need to change anything below here.
sec_file_def = {"obj-type":ABFile,

CHILD_CONTEXT_DEF["ABopenfile"] = {TYPE:OBJC,ARGS:(str,bool),EXCP:Exception,RETURN:sec_file_def,TARGET:ABopenfile}

# Execute the user code

================================================================================= Testing your security layer In this part of the assignment you will pretend to be an attacker. Remember the attacker’s objective is to bypass the A/B restrictions or cause the security layer to act in a disallowed manner. By understanding how the attacker thinks, you will be able to write better security layers.

An example of an attack is found below:

if "testfile.txt.a" in listfiles():
if "testfile.txt.b" in listfiles():
myfile=ABopenfile("testfile.txt",True)  #Create an AB file

# I should get 'SE' when reading an empty file...
assert('SE' == myfile.readat(None,0))

# put some valid data in the file.

# I should still get 'SE' because the file wasn't closed.
assert('SE' == myfile.readat(None,0))

#Close the file

In the example above, a successful attack would cause an error when assert(‘SE’== myfile.readat(None, 0)) is executed because the newly created valid file did not contain ‘SE’, meaning an invalid read occurred

If the example above executed without error, meaning that the newly created file contained ‘SE’, then the attack was successfully defended.

Note: All attacks should be written as Repy V2 files, using the .r2py extension.

Firstly: I’m not being snarky, but it needs to be said: the first thing you need is to take the time to read and understand what are valid topics for discussions forums…

This category is for the discussions relating to the Python Software Foundation .

The Python Software Foundation (PSF) is a 501©(3) non-profit corporation that holds the intellectual property rights behind the Python programming language. We manage the open source licensing for Python version 2.1 and later and own and protect the trademarks associated with Python. We also run the North American PyCon conference annually, support other Python conferences around the world, and fund Python related development with our grants program and by funding special projects.

This is a meta-category. It may be used by the Python Software Foundation staff to:

  • Post announcements about the PSF
  • Share news from the PSF
  • Link to resources the PSF provides

It is not to help users about programming. So, you should ask such question to places that are focused on helping learners, such as the learnpython subreddit or the python-tutor list.

Secondly, when posting about assignments questions, people will usually ask you to show them what you tried: they will not answer your assignment questions for you. If you don’t know where to start because you don’t know about programming in Python, you should either look for tutorials for beginners, or even consider dropping the course you are taking since you do not have the prerequisite knowledge and get back to it when you are ready. This is the advice that I gave to countless students in my past role as a student advisor.

Thank you.