CRITICAL
subprocess call uses shell=True, Command Injection risk
Issue Location
Vulnerable Code
app/utils/executor.py
Python
44import subprocess
45import os
46
47def run_command(user_input: str) -> str:
48 cmd = f"process_data {user_input}" # ⚠️ DANGER: directly concatenating user input
49 result = subprocess.run(cmd, shell=True, capture_output=True)
50 return result.stdout.decode()
51
52# Attack vector: user_input = "; rm -rf /"
🤖 LLM Fix Suggestion
✓ Recommended Fix
Change the command from string form to list form and remove
shell=True.
This way the system invokes the executable directly without shell parsing, eliminating injection risk. Also validate user_input with a whitelist, rejecting inputs containing special characters.
import subprocess
import re
ALLOWED_PATTERN = re.compile(r'^[a-zA-Z0-9_\-\.]+$')
def run_command(user_input: str) -> str:
# ✅ Whitelist validation
if not ALLOWED_PATTERN.match(user_input):
raise ValueError(f"Invalid input: {user_input!r}")
# ✅ List args, no shell=True
result = subprocess.run(
["process_data", user_input],
capture_output=True, timeout=30
)
return result.stdout.decode()
📚 Related Knowledge Articles
GET /api/v1/knowledge/search?q=command+injection&top_k=3
97.3%
OWASP Secure Coding — A03 Injection Defense
Command injection is one of the most severe types. Always use parameterized calls to external commands, never pass user-controlled data to shell parsers...
coding_standard
91.8%
Historic Defect #2341 — 2023 Payment System Command Injection
Attacker injected system commands via semicolons in filenames, gaining remote control. Root cause: subprocess with shell=True and no filename filtering...
defect_case
84.2%
Python Secure Dev Guide — Safe subprocess Usage
Python docs state: when shell=True, cmd is equivalent to passing to /bin/sh, interpreting all shell metacharacters...
coding_standard