Call of a spawn process without sanitization
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
ID: python-security/os-spawn
Language: Python
Severity: Error
Category: Security
CWE: 78
Description
Detect unsafe shell execution with the os module. We should ensure the command is safe before execution. Use shlex to sanitize user inputs.
Learn More
Non-Compliant Code Examples
import os
directory = "/tmp"
# Use of unsanitized data to create a process
os.spawnl(os.P_WAIT, "/bin/ls")
os.spawnle(os.P_WAIT, "/bin/ls")
os.spawnlp(os.P_WAIT, "/bin/ls")
os.spawnlpe(os.P_WAIT, "/bin/ls")
os.spawnv(os.P_WAIT, "/bin/ls")
os.spawnve(os.P_WAIT, "/bin/ls")
os.spawnvp(os.P_WAIT, "/bin/ls")
os.spawnvpe(os.P_WAIT, "/bin/ls")
os.spawnvpe(os.P_WAIT, "/bin/ls " + directory)
Compliant Code Examples
import os
import shlex
# Use of shlex() to sanitize data
os.spawnl(os.P_WAIT, shlex.escape("/bin/ls"))
