055598028a
When using functions like subprocess.Popen etc to launch an external executable, the full path should be given. This prevents an attacker from manipulting the search path or placing a bogus executable that will be launched instead of the intended one. Change-Id: I4a11f988bc3e954331ab0f0902ea849c6ec31888
16 lines
515 B
Python
16 lines
515 B
Python
import commands
|
|
import popen2
|
|
|
|
|
|
print(commands.getstatusoutput('/bin/echo / | xargs ls'))
|
|
print(commands.getoutput('/bin/echo / | xargs ls'))
|
|
|
|
# This one is safe.
|
|
print(commands.getstatus('/bin/echo / | xargs ls'))
|
|
|
|
print(popen2.popen2('/bin/echo / | xargs ls')[0].read())
|
|
print(popen2.popen3('/bin/echo / | xargs ls')[0].read())
|
|
print(popen2.popen4('/bin/echo / | xargs ls')[0].read())
|
|
print(popen2.Popen3('/bin/echo / | xargs ls').fromchild.read())
|
|
print(popen2.Popen4('/bin/echo / | xargs ls').fromchild.read())
|