Are there security concerns in passing sensitive data through a module's function?

Viewed 56

I recently learned about using named parameters for memoizing in functions. I had no idea this was possible - I don't intend for my code to memoize anything. I'm not good enough at Python to understand what's going on in memory when I run my app, and I'm not even sure what questions I should ask!

My two-file app (secrets_mgmt.py and class_app.py) is structured as below (run as user zeebrow):

# secrets_mgmt.py
import configparser

config = configparser.ConfigParser()
config.Read('my_diary.txt')    # 0600 zeebrow zeebrow /home/zeebrow/.myapp.secrets

def get_secrets():
    d = {}
    d['secret_1'] = config['section']['secret_1']
    d['secret_2'] = config['section']['secret_2']
    return d

I pass the sensitive data to a class, like this:

#class_app.py
from TPL import XYZ
from secrets_mgmt import get_secrets

class app(XYZ):
    def __init__(self):
        self.secrets = {}
        self.secrets['s1'] = secrets_mgmt.get_secrets()['secret_1']
        self.secrets['s2'] = secrets_mgmt.get_secrets()['secret_2']
        super().__init__(**self.secrets)
        del secrets

I'm probably missing more than I realize, but from what I could think to ask:

  • Are the values in self.secrets stored anywhere, even after I deleted them?
  • Is there anything specific I should check in the third-party library's XYZ class to make sure it handles sensitive info correctly? It uses requests.
  • I admit I'm blindly trusting configparser because it's a part of the standard library - Is this safe to do?
0 Answers
Related