fix security (#62626) (#62683)

python/paddle/base/core.py

@@ -14,6 +14,7 @@
 
 import os
 import platform
+import re
 import site
 import sys
 import warnings
@@ -194,8 +195,18 @@ def run_shell_command(cmd):
         return out.decode('utf-8').strip()
 
 
+def is_valid_filename(filename):
+    pattern = re.compile(r'^[a-zA-Z0-9_.-]+$')
+    if pattern.match(filename):
+        return True
+    else:
+        return False
+
+
 def get_dso_path(core_so, dso_name):
     if core_so and dso_name:
+        assert is_valid_filename(core_so), 'core_so must be a file name.'
+        assert is_valid_filename(dso_name), 'dso_name must be a file name.'
         return run_shell_command(
             f"ldd {core_so}|grep {dso_name}|awk '{{print $3}}'"
         )