055598028a
When using functions like subprocess.Popen etc to launch an external executable, the full path should be given. This prevents an attacker from manipulting the search path or placing a bogus executable that will be launched instead of the intended one. Change-Id: I4a11f988bc3e954331ab0f0902ea849c6ec31888
17 lines
479 B
Python
17 lines
479 B
Python
import os as o
|
|
import subprocess as subp
|
|
|
|
# Vulnerable to wildcard injection
|
|
o.system("/bin/tar xvzf *")
|
|
o.system('/bin/chown *')
|
|
o.popen2('/bin/chmod *')
|
|
subp.Popen('/bin/chown *', shell=True)
|
|
|
|
# Not vulnerable to wildcard injection
|
|
subp.Popen('/bin/rsync *')
|
|
subp.Popen("/bin/chmod *")
|
|
subp.Popen(['/bin/chown', '*'])
|
|
subp.Popen(["/bin/chmod", sys.argv[1], "*"],
|
|
stdin=subprocess.PIPE, stdout=subprocess.PIPE)
|
|
o.spawnvp(os.P_WAIT, 'tar', ['tar', 'xvzf', '*'])
|