hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #13782 from jorgectf/jorgectf/shlex-quote

Browse Source 
Python: Add `shlex.quote` as `py/shell-command-constructed-from-input` sanitizer
This commit is contained in:
yoff
2023-08-31 21:08:58 +02:00
committed by GitHub
parent 10548b57d7 8f8c064632
commit da64ea40b9
4 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
python/ql/test/query-tests/Security/CWE-078-UnsafeShellCommandConstruction/src/unsafe_shell_test.py
View File

@@ -46,4 +46,8 @@ def subprocess_flag (name):
subprocess.Popen("ping " + name, shell=unknownValue) # OK - shell assumed to be False
def intentional(command):
os.system("fish -ic " + command) # $result=OK - intentional
os.system("fish -ic " + command) # $result=OK - intentional
import shlex
def unsafe_shell_sanitized(name):
os.system("ping " + shlex.quote(name)) # $result=OK - sanitized