Unsafe execution of shell commands

문서 > 코드 분석 > Static Analysis Rules > Unsafe execution of shell commands

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Metadata

ID: python-security/asyncio-subprocess-exec

Language: Python

Severity: Error

Category: Security

CWE: 78

Description

Detect unsafe shell execution in the asyncio framework. When we invoke the shell, we should make sure that the data is safe and secure. Use shlex to sanitize user inputs.

Learn More

Non-Compliant Code Examples

import asyncio

def handler(event, context):
    # Should sanitize arguments
    async_loop.run_until_complete(async_loop.subprocess_exec(waiting_protocol, ["/bin/sh", "mycommand"]))

Compliant Code Examples

import asyncio
import shlex

def handler(event, context):
    # Should sanitize arguments
    async_loop.run_until_complete(async_loop.subprocess_exec(waiting_protocol, shlex.split(shlex.quote("/bin/sh mycommand"))))