subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 88% confidence
- Finding
The script executes shell commands, and one of them uses shell=True because of a pipeline. Although the current commands are hardcoded and not directly user-controlled, invoking a shell increases risk from environment manipulation, PATH hijacking, shell alias/function abuse, or unexpected behavior if this helper is later extended to accept external input.
- Content
python # 对于支持数组形式的命令使用 shell=False，带管道的命令仍需 shell=True use_shell = "|" in cmd or ">" in cmd try: result = subprocess.run(cmd, shell=use_shell, capture_output=True, text=True, timeout=10) output = (result.stdout + result.stderr).strip() return {"ok": result.returncode == 0, "cmd": cmd, "desc": desc, "detail": output[:200] if output else "命令执行成功但无输出"}