Skip to content

CWE-78 - subprocess.run with shell=true #9

@mocsharp

Description

@mocsharp

Wheeltamer reported the following high severity issues:

Issue: [B602:subprocess_popen_with_shell_equals_true] subprocess call with shell=True identified, security issue.
   Severity: High   Confidence: High
   CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
   More Info: https://bandit.readthedocs.io/en/1.7.10/plugins/b602_subprocess_popen_with_shell_equals_true.html
   Location: WHEEL_UNPACKED_DIR/holoscan_cli-0.0.0a0.dev22+vchangtestpypi.4dd8512/holoscan_cli/common/dockerutils.py:524:11
523             ["nvidia-smi --query-gpu name --format=csv,noheader | grep nvgpu -q"],
524             shell=True,
525         )
526         result = proc.returncode
527         return result == 0
>> Issue: [B602:subprocess_popen_with_shell_equals_true] subprocess call with shell=True identified, security issue.
   Severity: High   Confidence: High
   CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
   More Info: https://bandit.readthedocs.io/en/1.7.10/plugins/b602_subprocess_popen_with_shell_equals_true.html
   Location: WHEEL_UNPACKED_DIR/holoscan_cli-0.0.0a0.dev22+vchangtestpypi.4dd8512/holoscan_cli/common/utils.py:65:11
64          """
65          proc = subprocess.Popen(cmd, universal_newlines=True, shell=True)
66          return proc.wait()
>> Issue: [B602:subprocess_popen_with_shell_equals_true] subprocess call with shell=True identified, security issue.
   Severity: High   Confidence: High
   CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
   More Info: https://bandit.readthedocs.io/en/1.7.10/plugins/b602_subprocess_popen_with_shell_equals_true.html
   Location: WHEEL_UNPACKED_DIR/holoscan_cli-0.0.0a0.dev22+vchangtestpypi.4dd8512/holoscan_cli/common/utils.py:79:11
78          """
79          proc = subprocess.run(cmd, capture_output=True, text=True, shell=True)
80          return proc.stdout

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions