Skip to content

Commit 2b3e884

Browse files
maipbuimaipbui
authored
[nokia] Replace os.system and remove subprocess with shell=True (#12100)
Signed-off-by: maipbui <maibui@microsoft.com> Dependency: [https://github.com/sonic-net/sonic-buildimage/pull/12065](https://github.com/sonic-net/sonic-buildimage/pull/12065) #### Why I did it `subprocess.Popen()` and `subprocess.run()` is used with `shell=True`, which is very dangerous for shell injection. `os` - not secure against maliciously constructed input and dangerous if used to evaluate dynamic content `getstatusoutput` is dangerous because it contains `shell=True` in the implementation #### How I did it Replace `os` by `subprocess`, use with `shell=False` Remove unused functions
1 parent ec809bd commit 2b3e884

File tree

6 files changed

+40
-64
lines changed

6 files changed

+40
-64
lines changed

‎device/nokia/armhf-nokia_ixs7215_52x-r0/plugins/eeprom.py

+3-1
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,7 @@ class board(eeprom_tlvinfo.TlvInfoDecoder):
1010
def __init__(self, name, path, cpld_root, ro):
1111
self.eeprom_path = "/sys/class/i2c-adapter/i2c-0/0-0053/eeprom"
1212
if not os.path.exists(self.eeprom_path):
13-
os.system("echo 24c02 0x53 > /sys/class/i2c-adapter/i2c-0/new_device")
13+
file = "/sys/class/i2c-adapter/i2c-0/new_device"
14+
with open(file, 'w') as f:
15+
f.write('24c02 0x53\n')
1416
super(board, self).__init__(self.eeprom_path, 0, '', True)

‎platform/marvell-armhf/sonic-platform-nokia/7215/sonic_platform/chassis.py

+4-8
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
from sonic_platform.thermal import Thermal
1919
from sonic_platform.component import Component
2020
from sonic_py_common import logger
21+
from sonic_py_common.general import getstatusoutput_noshell
2122
except ImportError as e:
2223
raise ImportError(str(e) + "- required module not found")
2324

@@ -27,11 +28,6 @@
2728
except ImportError as e:
2829
smbus_present = 0
2930

30-
if sys.version_info[0] < 3:
31-
import commands as cmd
32-
else:
33-
import subprocess as cmd
34-
3531
MAX_SELECT_DELAY = 3600
3632
COPPER_PORT_START = 1
3733
COPPER_PORT_END = 48
@@ -209,7 +205,7 @@ def get_revision(self):
209205
string: Revision value of chassis
210206
"""
211207
if smbus_present == 0: # called from host
212-
cmdstatus, value = cmd.getstatusoutput('sudo i2cget -y 0 0x41 0x0')
208+
cmdstatus, value = getstatusoutput_noshell(['sudo', 'i2cget', '-y', '0', '0x41', '0x0'])
213209
else:
214210
bus = smbus.SMBus(0)
215211
DEVICE_ADDRESS = 0x41
@@ -331,7 +327,7 @@ def set_status_led(self, color):
331327

332328
# Write sys led
333329
if smbus_present == 0: # called from host (e.g. 'show system-health')
334-
cmdstatus, value = cmd.getstatusoutput('sudo i2cset -y 0 0x41 0x7 %d' % value)
330+
cmdstatus, value = getstatusoutput_noshell(['sudo', 'i2cset', '-y', '0', '0x41', '0x7', str(value)])
335331
if cmdstatus:
336332
sonic_logger.log_warning(" System LED set %s failed" % value)
337333
return False
@@ -353,7 +349,7 @@ def get_status_led(self):
353349
"""
354350
# Read sys led
355351
if smbus_present == 0: # called from host
356-
cmdstatus, value = cmd.getstatusoutput('sudo i2cget -y 0 0x41 0x7')
352+
cmdstatus, value = getstatusoutput_noshell(['sudo', 'i2cget', '-y', '0', '0x41', '0x7'])
357353
value = int(value, 16)
358354
else:
359355
bus = smbus.SMBus(0)

‎platform/marvell-armhf/sonic-platform-nokia/7215/sonic_platform/component.py

+18-25
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@
99

1010
try:
1111
import os
12-
import sys
1312
import subprocess
1413
import ntpath
1514
from sonic_platform_base.component_base import ComponentBase
15+
from sonic_py_common.general import getstatusoutput_noshell, getstatusoutput_noshell_pipe
1616
except ImportError as e:
1717
raise ImportError(str(e) + "- required module not found")
1818

@@ -22,11 +22,6 @@
2222
except ImportError as e:
2323
smbus_present = 0
2424

25-
if sys.version_info[0] < 3:
26-
import commands as cmd
27-
else:
28-
import subprocess as cmd
29-
3025

3126
class Component(ComponentBase):
3227
"""Nokia platform-specific Component class"""
@@ -35,29 +30,20 @@ class Component(ComponentBase):
3530
["System-CPLD", "Used for managing SFPs, LEDs, PSUs and FANs "],
3631
["U-Boot", "Performs initialization during booting"],
3732
]
38-
CPLD_UPDATE_COMMAND = 'cp /usr/sbin/vme /tmp; cp {} /tmp; cd /tmp; ./vme {};'
33+
CPLD_UPDATE_COMMAND1 = ['cp', '/usr/sbin/vme', '/tmp']
34+
CPLD_UPDATE_COMMAND2 = ['cp', '', '/tmp']
35+
CPLD_UPDATE_COMMAND3 = ['cd', '/tmp']
36+
CPLD_UPDATE_COMMAND4 = ['./vme', '']
3937

4038
def __init__(self, component_index):
4139
self.index = component_index
4240
self.name = self.CHASSIS_COMPONENTS[self.index][0]
4341
self.description = self.CHASSIS_COMPONENTS[self.index][1]
4442

45-
def _get_command_result(self, cmdline):
46-
try:
47-
proc = subprocess.Popen(cmdline.split(), stdout=subprocess.PIPE,
48-
stderr=subprocess.STDOUT)
49-
stdout = proc.communicate()[0]
50-
proc.wait()
51-
result = stdout.rstrip('\n')
52-
except OSError:
53-
result = None
54-
55-
return result
56-
5743
def _get_cpld_version(self, cpld_number):
5844

5945
if smbus_present == 0:
60-
cmdstatus, cpld_version = cmd.getstatusoutput('sudo i2cget -y 0 0x41 0x2')
46+
cmdstatus, cpld_version = getstatusoutput_noshell(['sudo', 'i2cget', '-y', '0', '0x41', '0x2'])
6147
else:
6248
bus = smbus.SMBus(0)
6349
DEVICE_ADDRESS = 0x41
@@ -144,7 +130,10 @@ def get_firmware_version(self):
144130
return self._get_cpld_version(self.index)
145131

146132
if self.index == 1:
147-
cmdstatus, uboot_version = cmd.getstatusoutput('grep --null-data U-Boot /dev/mtd0ro|head -1 | cut -d" " -f2-4')
133+
cmd1 = ['grep', '--null-data', 'U-Boot', '/dev/mtd0ro']
134+
cmd2 = ['head', '-1']
135+
cmd3 = ['cut', '-d', ' ', '-f2-4']
136+
cmdstatus, uboot_version = getstatusoutput_noshell_pipe(cmd1, cmd2, cmd3)
148137
return uboot_version
149138

150139
def install_firmware(self, image_path):
@@ -165,12 +154,16 @@ def install_firmware(self, image_path):
165154
print("ERROR: the cpld image {} doesn't exist ".format(image_path))
166155
return False
167156

168-
cmdline = self.CPLD_UPDATE_COMMAND.format(image_path, image_name)
157+
self.CPLD_UPDATE_COMMAND2[1] = image_path
158+
self.CPLD_UPDATE_COMMAND4[1] = image_name
169159

170160
success_flag = False
171-
172-
try:
173-
subprocess.check_call(cmdline, stderr=subprocess.STDOUT, shell=True)
161+
162+
try:
163+
subprocess.check_call(self.CPLD_UPDATE_COMMAND1, stderr=subprocess.STDOUT)
164+
subprocess.check_call(self.CPLD_UPDATE_COMMAND2, stderr=subprocess.STDOUT)
165+
subprocess.check_call(self.CPLD_UPDATE_COMMAND3, stderr=subprocess.STDOUT)
166+
subprocess.check_call(self.CPLD_UPDATE_COMMAND4, stderr=subprocess.STDOUT)
174167
success_flag = True
175168
except subprocess.CalledProcessError as e:
176169
print("ERROR: Failed to upgrade CPLD: rc={}".format(e.returncode))

‎platform/marvell-armhf/sonic-platform-nokia/7215/sonic_platform/psu.py

+5-10
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,13 @@
88

99
try:
1010
import os
11-
import sys
1211
from sonic_platform_base.psu_base import PsuBase
1312
from sonic_py_common import logger
1413
from sonic_platform.eeprom import Eeprom
14+
from sonic_py_common.general import getstatusoutput_noshell
1515
except ImportError as e:
1616
raise ImportError(str(e) + "- required module not found")
1717

18-
if sys.version_info[0] < 3:
19-
import commands as cmd
20-
else:
21-
import subprocess as cmd
22-
2318
smbus_present = 1
2419
try:
2520
import smbus
@@ -86,7 +81,7 @@ def get_presence(self):
8681
"""
8782

8883
if smbus_present == 0: # if called from psuutil outside of pmon
89-
cmdstatus, psustatus = cmd.getstatusoutput('sudo i2cget -y 0 0x41 0xa')
84+
cmdstatus, psustatus = getstatusoutput_noshell(['sudo', 'i2cget', '-y', '0', '0x41', '0xa'])
9085
psustatus = int(psustatus, 16)
9186
else:
9287
bus = smbus.SMBus(0)
@@ -150,7 +145,7 @@ def get_status(self):
150145
"""
151146

152147
if smbus_present == 0:
153-
cmdstatus, psustatus = cmd.getstatusoutput('sudo i2cget -y 0 0x41 0xa')
148+
cmdstatus, psustatus = getstatusoutput_noshell(['sudo', 'i2cget', '-y', '0', '0x41', '0xa'])
154149
psustatus = int(psustatus, 16)
155150
sonic_logger.log_warning("PMON psu-smbus - presence = 0 ")
156151
else:
@@ -179,7 +174,7 @@ def get_voltage(self):
179174
e.g. 12.1
180175
"""
181176
if smbus_present == 0:
182-
cmdstatus, psustatus = cmd.getstatusoutput('sudo i2cget -y 0 0x41 0xa')
177+
cmdstatus, psustatus = getstatusoutput_noshell(['sudo', 'i2cget', '-y', '0', '0x41', '0xa'])
183178
psustatus = int(psustatus, 16)
184179
else:
185180
bus = smbus.SMBus(0)
@@ -226,7 +221,7 @@ def get_powergood_status(self):
226221
"""
227222

228223
if smbus_present == 0:
229-
cmdstatus, psustatus = cmd.getstatusoutput('sudo i2cget -y 0 0x41 0xa')
224+
cmdstatus, psustatus = getstatusoutput_noshell(['sudo', 'i2cget', '-y', '0', '0x41', '0xa'])
230225
psustatus = int(psustatus, 16)
231226
else:
232227
bus = smbus.SMBus(0)

‎platform/marvell-armhf/sonic-platform-nokia/7215/sonic_platform/sfp.py

+8-13
Original file line numberDiff line numberDiff line change
@@ -3,23 +3,18 @@
33
#
44
#############################################################################
55

6-
import os
7-
import sys
6+
import subprocess
87

98
try:
109
from sonic_platform_base.sfp_base import SfpBase
1110
from sonic_platform_base.sonic_sfp.sff8472 import sff8472InterfaceId
1211
from sonic_platform_base.sonic_sfp.sff8472 import sff8472Dom
1312
from sonic_platform_base.sonic_sfp.sfputilhelper import SfpUtilHelper
1413
from sonic_py_common import logger
14+
from sonic_py_common.general import getstatusoutput_noshell
1515
except ImportError as e:
1616
raise ImportError(str(e) + "- required module not found")
1717

18-
if sys.version_info[0] < 3:
19-
import commands as cmd
20-
else:
21-
import subprocess as cmd
22-
2318
smbus_present = 1
2419

2520
try:
@@ -118,7 +113,7 @@ class Sfp(SfpBase):
118113
# Paths
119114
PLATFORM_ROOT_PATH = "/usr/share/sonic/device"
120115
PMON_HWSKU_PATH = "/usr/share/sonic/hwsku"
121-
HOST_CHK_CMD = "docker > /dev/null 2>&1"
116+
HOST_CHK_CMD = ["docker"]
122117

123118
PLATFORM = "armhf-nokia_ixs7215_52x-r0"
124119
HWSKU = "Nokia-7215"
@@ -186,7 +181,7 @@ def __convert_string_to_num(self, value_str):
186181
return 'N/A'
187182

188183
def __is_host(self):
189-
return os.system(self.HOST_CHK_CMD) == 0
184+
return subprocess.call(self.HOST_CHK_CMD) == 0
190185

191186
def __get_path_to_port_config_file(self):
192187
platform_path = "/".join([self.PLATFORM_ROOT_PATH, self.PLATFORM])
@@ -811,7 +806,7 @@ def tx_disable(self, tx_disable):
811806
return False
812807

813808
if smbus_present == 0: # if called from sfputil outside of pmon
814-
cmdstatus, register = cmd.getstatusoutput('sudo i2cget -y 0 0x41 0x5')
809+
cmdstatus, register = getstatusoutput_noshell(['sudo', 'i2cget', '-y', '0', '0x41', '0x5'])
815810
if cmdstatus:
816811
sonic_logger.log_warning("sfp cmdstatus i2c get failed %s" % register )
817812
return False
@@ -824,13 +819,13 @@ def tx_disable(self, tx_disable):
824819

825820
pos = [1, 2, 4, 8]
826821
mask = pos[self.index-SFP_PORT_START]
827-
if tx_disable == True:
822+
if tx_disable is True:
828823
setbits = register | mask
829824
else:
830825
setbits = register & ~mask
831826

832827
if smbus_present == 0: # if called from sfputil outside of pmon
833-
cmdstatus, output = cmd.getstatusoutput('sudo i2cset -y -m 0x0f 0 0x41 0x5 %d' % setbits)
828+
cmdstatus, output = getstatusoutput_noshell(['sudo', 'i2cset', '-y', '-m', '0x0f', '0', '0x41', '0x5', str(setbits)])
834829
if cmdstatus:
835830
sonic_logger.log_warning("sfp cmdstatus i2c write failed %s" % output )
836831
return False
@@ -912,7 +907,7 @@ def get_presence(self):
912907
return False
913908

914909
if smbus_present == 0: # if called from sfputil outside of pmon
915-
cmdstatus, sfpstatus = cmd.getstatusoutput('sudo i2cget -y 0 0x41 0x3')
910+
cmdstatus, sfpstatus = getstatusoutput_noshell(['sudo', 'i2cget', '-y', '0', '0x41', '0x3'])
916911
sfpstatus = int(sfpstatus, 16)
917912
else:
918913
bus = smbus.SMBus(0)

‎platform/marvell-armhf/sonic-platform-nokia/7215/sonic_platform/sfp_event.py

+2-7
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
'''
22
listen for the SFP change event and return to chassis.
33
'''
4-
import sys
54
import time
65
from sonic_py_common import logger
6+
from sonic_py_common.general import getstatusoutput_noshell
77

88
smbus_present = 1
99

@@ -12,11 +12,6 @@
1212
except ImportError as e:
1313
smbus_present = 0
1414

15-
if sys.version_info[0] < 3:
16-
import commands as cmd
17-
else:
18-
import subprocess as cmd
19-
2015
# system level event/error
2116
EVENT_ON_ALL_SFP = '-1'
2217
SYSTEM_NOT_READY = 'system_not_ready'
@@ -51,7 +46,7 @@ def deinitialize(self):
5146
def _get_transceiver_status(self):
5247
if smbus_present == 0:
5348
sonic_logger.log_info(" PMON - smbus ERROR - DEBUG sfp_event ")
54-
cmdstatus, sfpstatus = cmd.getstatusoutput('sudo i2cget -y 0 0x41 0x3')
49+
cmdstatus, sfpstatus = getstatusoutput_noshell(['sudo', 'i2cget', '-y', '0', '0x41', '0x3'])
5550
sfpstatus = int(sfpstatus, 16)
5651
else:
5752
bus = smbus.SMBus(0)

0 commit comments

Comments
 (0)