-
Notifications
You must be signed in to change notification settings - Fork 142
Conversation
On Unix, with shell=True, the shell default to /bin/sh. Using Popen(['type', command], shell=True) is equivalent to calling Popen(['/bin/sh', '-c', 'type', command]). In this case 'command' becomes a positional parameter to the shell, and not an argument to the command 'type'. The solution is to pass a single string as parameter. The problem is that with shell=True, we are never safe from a shell injection, so it is wiser to use a python only solution. The package distutils is part of the standard distribution, so it doesn't add extra dependencies. The method find_executable has the same behaviour as 'which' on bash.
I checked out the implementation of
Note that there is no check for executability. Also, we will not be able to check the availability of shell functions or shell builtins with this. I think your suggestion of making the whole checking command a string might be a better solution to this problem, we needn't worry about shell injection too much, since all of the input is trusted. |
Find_executable returns a file in the path, so it must be checked for executability.
I have updated with an executability check. |
eh, true. Alright, I'm fine with merging this. Nice touch with adding debug logging, since there is no |
Merge pull request andsens#407 from zmarano/master Remove the bits that disabled IPv6 for GCE. pep8: Fix E722 do not use bare except' ec2: Move cloud-init mount tuning to cloud-init plugin Fixes andsens#406 Fix bug in Stretch builds. sshd_config no longer contains PermitRootLogin. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=852781 Merge pull request andsens#372 from zmarano/master Fix an ordering issue with the expand-root plugin. Merge pull request andsens#374 from liori/documentation-fixes fix some typos in documentation Merge pull request andsens#375 from zmarano/master Enable SCSI block multiqueue for GCE Stretch images. Merge pull request andsens#378 from Exy13/loops Fix loopdevice partitions not being unmapped correctly Merge pull request andsens#381 from Exy13/lvm Add LVM as a disk backend Merge pull request andsens#383 from Exy13/qcow Add qcow2 as a disk backend for KVM Merge pull request andsens#384 from zmarano/master Promote stretch to stable, add buster as testing, jessie to oldstable. Merge pull request andsens#385 from liori/lone-dpkg Fix lone minimize_size/dpkg without apt Merge pull request andsens#386 from liori/minimize-size-bindmount-permissions minimize_size: make sure the permissions of bindmounts are preserved Merge pull request andsens#382 from Exy13/existing_commands Fix unfailing CheckExternalCommands Make trusted-keys paths in manifest relative to manifest ansible: Make playbook path relative to manifest ansible: Check for ansible availability before running vbox: Make guest additions path relative to manifest ansible: Change tags/skip-tags to be lists and shorten task ansible hosts -> groups ansible: Fix extra_vars so that it actually works Also remove tmp_cmd var and fix manifest schema ansible: Remove erroneous whitespace commands plugin: Run copy files before running commands This is quite useful in situations where you want to do something with the assets that you have copied into the image. One could argue for the opposite case as well, but with the commands plugin you always have the manual "cp" escape hatch. Merge pull request andsens#390 from indigoid/readme-escaping-note brief note about escaping braces in manifests Merge pull request andsens#391 from NeatNerdPrime/puppet_module_upgrade Puppet tasks fix commit Partitions: Fix check for additional partitions on single part. Merge pull request andsens#392 from gplessis/empty-ami-names Don’t crash on empty AMI name Merge pull request andsens#395 from zmarano/master Add GCE buster builds. Update Google Compute Engine package and repository structure. GCE packages are now Debian policy compliant. Merge pull request andsens#396 from NeatNerdPrime/puppet_update_stretch Stretch update commit Update doc Merge pull request andsens#398 from jmporcelg/issue-397 andsens#397 fix: Installing networking kernel driver using DKMS fails in stretch Merge pull request andsens#400 from Exy13/doc Update misleading documentation Fix tabs vs. spaces in changelog Merge pull request andsens#414 from CMeza99/netbase allow networking task when netbase pkg is present Added security field to packages. Updated Readme and example manifest for jessie-lvm kmv Merge pull request andsens#415 from ashegedus/config-security Added security field to packages. Merge pull request andsens#417 from ashegedus/password-crypt Add password-crypt to root password plugin Merge pull request andsens#422 from CMeza99/fix-intel-url update intel ixgbevf url Merge pull request andsens#428 from octivi/systemd_expand_root Change location of expand-root systemd unit from /lib/... to /etc/...
On Unix, with
shell=True
, the shell default to /bin/sh.Using
Popen(['type', command], shell=True)
is equivalent to callingPopen(['/bin/sh', '-c', 'type', command])
.In this case
'command'
becomes a positional parameter to the shell,and not an argument to the command
'type'
.One solution would be to pass a single string as parameter.
The problem is that with
shell=True
, we wouldn't be safe from a shell injection,so it is wiser to use a python only solution.
The package distutils is part of the standard distribution, so it doesn't add
extra dependencies.
The method find_executable has the same behaviour as 'which' on bash, it
will return the path to the executable or
None
if it was not found.Logging needs to be added as it was previously handled by log_check_call().
This fixes #380 which was broken here.