Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
••••••••
Sichere ProgrammierungI built a tool that makes images bigger, not smaller – here's why(25.09.2026 um 05:56 Uhr)
••••••••••
Sichere ProgrammierungI built a tool that makes images bigger, not smaller – here's why(25.09.2026 um 05:56 Uhr)
••
Intelligence View
⚡ tsecurity.de Intelligence

CodeSOD: In the Know

Delilah works in a Python shop. Despite Python's "batteries included" design, that doesn't stop people from trying to make their own batteries from potatoes. For example, her co-worker wrote this function: def key_exists(element, key): …

0
↗ Quelle (thedailywtf.com)
Reagiere als Erste:r — dein Feedback zählt!

Delilah works in a Python shop. Despite Python's "batteries included" design, that doesn't stop people from trying to make their own batteries from potatoes. For example, her co-worker wrote this function:


def key_exists(element, key):
if isinstance(element, dict):
try:
element = element[key]
except KeyError:
return False
return True

Python, of course, has an in operator. key in dictionary is an extremely common idiom. There's no reason to implement your own. Certainly, there's no reason to re-implement it by catching and throwing exceptions.


This is ugly, stupid, and bad. It gets worse, though, when you see how it gets used.


for key in old_yaml_data:
if key in new_yaml_data:
if old_yaml_data[key] != new_yaml_data[key]:
temp = new_yaml_data[key]
new_yaml_data[key] = merge(new_yaml_data[key], old_yaml_data[key])

if key_exists(new_yaml_data[key], 'image') and key_exists(old_yaml_data[key], 'image'):
new_yaml_data[key]['image'] = temp['image']
elif key == "databases":
revert_db_tags(new_yaml_data[key], temp)

This code is attempting to upgrade "old" YAML data with "new" data. So it's basically merging dictionaries, which is a great case for the in operator.


And they use the correct idiom on the second line there! This was written by one developer! They do the standard key in new_yaml_data check. And they also use key_exists. I can only assume that they had a stroke between starting and finishing this script, which I'll note is, in total, 48 lines long.


Here's the whole short script, which is just generally a mess. Slapped together Python code that's trying to be a "smarter" shell script, but is definitely written with the elegance of hacked-together-bash.


import sys
import yaml
from jsonmerge import merge

appHomePath = sys.argv[1]
oldValuesYAML = appHomePath + "values.yaml"
newValuesYAML = appHomePath + "/upgrade_version/values.yaml"
with open(newValuesYAML, 'r') as f:
new_yaml_data = yaml.load(f, Loader=yaml.loader.FullLoader)
with open(oldValuesYAML, 'r') as f:
old_yaml_data = yaml.load(f, Loader=yaml.loader.FullLoader)
def key_exists(element, key):
if isinstance(element, dict):
try:
element = element[key]
except KeyError:
return False
return True

def revert_db_tags(old_yaml_data, new_yaml_data):
dbList = ["mongoDB", "postgresDB"]
mongoDbTagsToRevert = ["mongoRestore"]
mongodbKeysToDelete = []
postgresDbTagsToRevert = []


for db in dbList:
old_yaml_data[db]['image'] = new_yaml_data[db]['image']
for mongoDbTag in mongoDbTagsToRevert:
old_yaml_data['mongoDB'][mongoDbTag]['image'] = new_yaml_data['mongoDB'][mongoDbTag]['image']
for mongoDbTag in mongoKeysToDelete:
del old_yaml_data['mongoDB'][mongoDbTag]

for postgresDbTag in postgresDbTagsToRevert:
old_yaml_data['postgresDB'][postgresDbTag]['image'] = new_yaml_data['postgresDB'][postgresDbTag]['image']

for key in old_yaml_data:
if key in new_yaml_data:
if old_yaml_data[key] != new_yaml_data[key]:
temp = new_yaml_data[key]
new_yaml_data[key] = merge(new_yaml_data[key], old_yaml_data[key])

if key_exists(new_yaml_data[key], 'image') and key_exists(old_yaml_data[key], 'image'):
new_yaml_data[key]['image'] = temp['image']
elif key == "databases":
revert_db_tags(new_yaml_data[key], temp)

with open(newValuesYAML, 'w') as f:
data = yaml.dump(new_yaml_data, f, sort_keys=False)


[Advertisement] Plan Your .NET 9 Migration with Confidence
Your journey to .NET 9 is more than just one decision.Avoid migration migraines with the advice in this free guide. Download Free Guide Now!

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Vulnerability Remediation & Verification
Syntax validiert (0 Fehler)
title: Detect Exploitation - CodeSOD: In the Know
id: 3e755911-a34a-43ab-bd93-6c7c5a4087eb
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "CodeSOD: In the Know" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("CodeSOD In the Know")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*CodeSOD In the Know*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "CodeSOD In the Know"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich CodeSOD: In the Know.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten CodeSOD: In the Know

Thematisch verwandte Begriffe: CodeSOD, Know · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-87722 | Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search q…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag