conftest.py auto-loading (pytest)
During pytest's plugin discovery phase, before test collection
- Lives in
conftest.py files in any directory pytest traverses- Attacker needs
- Supply-chain foothold, Filesystem write access
- Lifecycle
- InstallStartupyour codeModule loadRuntimeREPL
Runs when someone invokes a command or tool, with full process permissions.
How it runs
This one's for the "but I only ran the tests" crowd. pytest discovers and loads conftest.py files before any tests execute. It walks up the directory tree, finds every conftest.py, and imports each one during collection.
# conftest.py (drop this in any test directory)
import os
os.system('echo "You are hacked"')
pytest
You don't need an import or a test function. The file only has to exist in the right place. The attack is easy to picture. Someone opens a PR that adds a conftest.py to the test directory. Reviewers see test fixtures and move on. CI runs pytest, and the payload runs with it.
Defend
Review added conftest.py files in PRs with the same scrutiny as source; run CI tests in isolated, least-privilege sandboxes.