T09 · Insecure Skill Coding Practices
Error
- Location
scripts/train_loop.py:22- Finding
Command Validation Can Be Bypassed Through Shells and Interpreters
- Content
View full analysis
", ">>", "<"]): raise ValueError("Shell operators are not allowed in command string.") args = shlex.split(command, posix=(os.name != "nt")) dangerous_tokens = {"&&", "||", ";", "|", ">", ">>", "<", "2>", "&"} if any(token in dangerous_tokens for token in args): raise ValueError("Shell operators are not allowed. Provide a direct executable command.") return args def run_command(command): """ Runs the command safely with shell disabled and captures output. """ args = parse_safe_command(command) print(f"Executing (safe argv): {args}") try: result = subprocess.run(args, shell=False, check=True, capture_output=True, text=True) return result.stdout, result.stderr ``` ### Technical Analysis The validation only rejects shell operators when they appear directly in the original non-JSON command string or as standalone elements of the final argument list. It does not restrict which executable may be launched. Setting `shell=False` prevents Python from implicitly invoking a command shell, but it does not make arbitrary executables safe. A caller can explicitly choose ...[truncated 2140 chars]- Remediation
View remediation