pytest-testinfra icon indicating copy to clipboard operation
pytest-testinfra copied to clipboard
verified publisher icon pytest-dev

Is 'shell=True' necessary in base.py?

Open huornlmj opened this issue 5 years ago • 0 comments

https://github.com/philpep/testinfra/blob/87efc13b206f1957207bad14bf7db83ae05ef4f3/testinfra/backend/base.py#L194

Input appears to come from PIPE, and running shell=True is high risk. Is it possible that this could be changed to shell=False? Or use pipes.quote() to help escape whitespace and shell metacharacters from input?

huornlmj avatar Jan 16 '20 12:01 huornlmj