Skip to content
This repository was archived by the owner on Dec 19, 2022. It is now read-only.

Conversation

@nashant
Copy link

@nashant nashant commented Jun 14, 2020

No description provided.

@micolous
Copy link

micolous commented Aug 1, 2021

This is a really neat idea, but this implementation adds an arbitrary code execution vulnerability:

>>> command="cec_client ';echo 'hello world';#".split(' ')
>>> os.system("echo '{}' | cec-client -s".format(" ".join(command[1:])))

hello world
0

@bkanuka
Copy link

bkanuka commented Sep 4, 2021

You can quote strings and remove the security issues by using shlex.quote

Likewise the split(" ") should probably use shlex.split instead.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants