subprocess module call
Medium
- Category
- Dangerous Code Execution
- Content
"""执行命令""" print(f"执行: {cmd}") try: result = subprocess.run(cmd, shell=True, capture_output=True, text=True) if result.returncode != 0: print(f"错误: {result.stderr}") return result.returncode == 0- Confidence
- 98% confidence
- Finding
- The script builds shell command strings from externally supplied parameters such as server_host, server_user, server_pass, server_path, date, and slug, then executes them with shell=True. This enables command injection if any parameter contains shell metacharacters, and the risk is amplified because the script handles server credentials and performs remote file operations.