Importing public Github repositories is often necessary in coding. However, very often Github repositories contain malicious codes that can send sensitive data to hacker IP. There are CodeQL and Semgrep that check malicious codes, but they don't support all languages. Also, they can't distinguish benign uploads and malicious uploads. (Hackers can always upload sensitive data in the name of 'cloud service', 'log', etc) I concluded that codes need a network control that would prevent unknown network connections. Based on my research, there were two solutions. Code level network control. For example, Python's socket can be patched to only allow certain connections. However, it only applies to Python sockets, and cannot prevent sockets run in imports written in other languages. Is there a code-level network control method that prevents all network connections, unless explicitly allowed in code? Kernel level network control. This means using OS Firewall, or running in Docker with specific firewall config. I tried adding the connected python.exe to Windows Firewall Outbound Rules, but it had no effect. How can OS firewall be correctly configured to control network connection? Or, is there a better method? Thanks! Continue reading...
