updates to avoid shell injection vulnerability #22 #42
Conversation
|
Thank you for your pull request and welcome to our community. We require contributors to sign our Contributor License Agreement, and we don't seem to have the users @Just2Deep on file. In order for us to review and merge your code, please contact the project maintainers to get yourself added. |
|
Thank you for your pull request and welcome to our community. We require contributors to sign our Contributor License Agreement, and we don't seem to have the users @Just2Deep on file. In order for us to review and merge your code, please contact the project maintainers to get yourself added. |
|
I have read the CLA Document and I hereby sign the CLA. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| except: | ||
| raise EnvironmentError() | ||
| else: | ||
| subprocess.run(["source", ".env"], check=True) |
Check notice
Code scanning / Bandit
Starting a process with a partial executable path Note
| except: | ||
| raise EnvironmentError() | ||
| else: | ||
| subprocess.run(["source", ".env"], check=True) |
Check notice
Code scanning / Bandit
subprocess call - check for execution of untrusted input. Note
| def install(packages): | ||
| if packages == "pip install fastapi[all]": | ||
| subprocess.call("pip install fastapi[all]", shell=True) | ||
| packages = packages.split(" ") # passing as list of commands | ||
| subprocess.run(packages, check=True) |
Check notice
Code scanning / Bandit
subprocess call - check for execution of untrusted input. Note
| for package in packages:subprocess.call(package, shell=True) | ||
| else:subprocess.call(packages, shell=True) | ||
| for package in packages: | ||
| subprocess.run(package.split(" "), check=True) |
Check notice
Code scanning / Bandit
subprocess call - check for execution of untrusted input. Note
| for package in packages: | ||
| subprocess.run(package.split(" "), check=True) | ||
| else: | ||
| subprocess.run(packages.split(" "), check=True) |
Check notice
Code scanning / Bandit
subprocess call - check for execution of untrusted input. Note
| b = b.split(" ") # split commands into a list | ||
| if b[0] == "python": | ||
| b[0] = sys.executable # to support execution of script in windows | ||
| subprocess.run(b, check=True) |
Check notice
Code scanning / Bandit
subprocess call - check for execution of untrusted input. Note
P.S there are some formatting changes(single quote to double quotes) due to Black Formatter, Hope that is okay