diff options
| -rw-r--r-- | Doc/library/logging.config.rst | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/Doc/library/logging.config.rst b/Doc/library/logging.config.rst index 5a3e686..a1b8dc7 100644 --- a/Doc/library/logging.config.rst +++ b/Doc/library/logging.config.rst @@ -191,6 +191,20 @@ in :mod:`logging` itself) and defining handlers which are declared either in :func:`listen`. +Security considerations +^^^^^^^^^^^^^^^^^^^^^^^ + +The logging configuration functionality tries to offer convenience, and in part this +is done by offering the ability to convert text in configuration files into Python +objects used in logging configuration - for example, as described in +:ref:`logging-config-dict-userdef`. However, these same mechanisms (importing +callables from user-defined modules and calling them with parameters from the +configuration) could be used to invoke any code you like, and for this reason you +should treat configuration files from untrusted sources with *extreme caution* and +satisfy yourself that nothing bad can happen if you load them, before actually loading +them. + + .. _logging-config-dictschema: Configuration dictionary schema |