popen call with shell equals True BAN-B602
25 mydir = str(output.splitlines())
26 cmd = "du -a " + mydir + "/community " + mydir + \
27 "/conference | grep package.json | awk '{print $2}'"
28 output = subprocess.check_output(cmd, shell=True)
29 gf_all = []
30 for gf in output.splitlines():
31 try:
18class GetFiles():
19 def get_group_files(self):
20 cmd = "find ~/ -name TGmeetup | sed -n '1p'"
21 output = subprocess.check_output(cmd, shell=True)
22 try:
23 mydir = str(output.splitlines()).split("'")[1]
24 except BaseException:
33 pass
34 cmd = "du -a " + mydir + "/community " + mydir + \
35 "/conference | grep package.json | awk '{print $2}'"
36 output = subprocess.check_output(cmd, shell=True)
37 gf_all = []
38 for gf in output.splitlines():
39 try:
63 pass
64 cmd = "du -a " + mydir + "/community " + mydir + "/conference | grep " + \
65 country + "/" + name + "/package.json | awk '{print $2}'"
66 organization_file = subprocess.check_output(cmd, shell=True)
67 data = json.load(
68 open(str(organization_file.splitlines()).split("'")[1]))
69 return data
42 pass
43 cmd = "du -a " + mydir + "/community " + mydir + "/conference | grep " + \
44 country + " | grep package.json | awk '{print $2}'"
45 organization_file = subprocess.check_output(cmd, shell=True)
46 all_org = []
47 for org in organization_file.splitlines():
48 try:
Using shell=True can expose you to security risks if someone crafts input to issue different commands than the ones you intended.
Python possesses many mechanisms to invoke an external executable. However, doing so may present a security issue if appropriate care is not taken to sanitize any user-provided or variable input. Subprocess invocation using a command shell is dangerous as it is vulnerable to various shell injection attacks. It is possible for an attacker to craft inputs to issue different commands than the ones you intended, for example: removing a file.
Great care should be taken to sanitize all input in order to mitigate this risk. Calls of this type are identified by a parameter of shell=True being given.
It is recommended to use functions that don't spawn a shell. If you must use them, use shlex.quote to sanitize the input.
Bad practice
import subprocess
subprocess.Popen(cmd, shell=True) # Sensitive, shell spawned
Recommended
import subprocess
subprocess.Popen(cmd)
References:
- subprocess.popen
- Subprocess security considerations
- shlex
- Command Injection
- OWASP Top 10 2021 Category A03 - Injection
- SANS Top 25
- CWE-78