已合并
fix command injection vulnerability #516
starchen_创建于 14 天前
fix command injection vulnerability #516
已合并
共 3 个文件变更+9-5
| @@ -17,6 +17,7 @@ | |||
| 17 | # ---------------------------------------------------------------------------- | 17 | # ---------------------------------------------------------------------------- |
| 18 | 18 | ||
| 19 | import os | 19 | import os |
| 20 | +import shlex | ||
| 20 | import stat | 21 | import stat |
| 21 | import time | 22 | import time |
| 22 | import sys | 23 | import sys |
| @@ -422,7 +423,8 @@ class AsysAnalyze: | |||
| 422 | return False | 423 | return False |
| 423 | if self.path: | 424 | if self.path: |
| 424 | log_debug(f"msaicerr analyze path {self.path}") | 425 | log_debug(f"msaicerr analyze path {self.path}") |
| 425 | - cmd = f"{sys.executable} {msaicerr_path} -p {self.path} -dev {self.device_id} -out {output_path}" | 426 | + cmd = (f"{sys.executable} {msaicerr_path} -p {shlex.quote(self.path)} " |
| 427 | + f"-dev {self.device_id} -out {shlex.quote(output_path)}") | ||
| 426 | else: | 428 | else: |
| 427 | asys_collector = AsysCollect() | 429 | asys_collector = AsysCollect() |
| 428 | task_res = AsysCollect().run() | 430 | task_res = AsysCollect().run() |
| @@ -430,8 +432,8 @@ class AsysAnalyze: | |||
| 430 | if not task_res: | 432 | if not task_res: |
| 431 | log_error(f"Asys collect log failed") | 433 | log_error(f"Asys collect log failed") |
| 432 | return False | 434 | return False |
| 433 | - cmd = (f"{sys.executable} {msaicerr_path} -p {asys_collector.output_root_path} -dev {self.device_id}" | 435 | + cmd = (f"{sys.executable} {msaicerr_path} -p {shlex.quote(str(asys_collector.output_root_path))} " |
| 434 | - f" -out {output_path}") | 436 | + f"-dev {self.device_id} -out {shlex.quote(output_path)}") |
| 435 | log_debug(f"Start run: {cmd}") | 437 | log_debug(f"Start run: {cmd}") |
| 436 | res = real_time_output(cmd) | 438 | res = real_time_output(cmd) |
| 437 | self.clean_output() | 439 | self.clean_output() |
| @@ -17,6 +17,7 @@ | |||
| 17 | # ---------------------------------------------------------------------------- | 17 | # ---------------------------------------------------------------------------- |
| 18 | 18 | ||
| 19 | import os.path | 19 | import os.path |
| 20 | +import shlex | ||
| 20 | import threading | 21 | import threading |
| 21 | 22 | ||
| 22 | from common.const import GET_DEVICES_INFO_TIMEOUT, STACKTRACE | 23 | from common.const import GET_DEVICES_INFO_TIMEOUT, STACKTRACE |
| @@ -68,7 +69,7 @@ class AsysCollect: | |||
| 68 | def _device_file_export(self): | 69 | def _device_file_export(self): |
| 69 | def run_msnpureport(export_dir_path): | 70 | def run_msnpureport(export_dir_path): |
| 70 | f.create_dir(export_dir_path) | 71 | f.create_dir(export_dir_path) |
| 71 | - export_dir_cmd = "cd " + export_dir_path | 72 | + export_dir_cmd = "cd " + shlex.quote(export_dir_path) |
| 72 | export_tool = "msnpureport -f" | 73 | export_tool = "msnpureport -f" |
| 73 | export_cmd = "{0};{1}".format(export_dir_cmd, export_tool) | 74 | export_cmd = "{0};{1}".format(export_dir_cmd, export_tool) |
| 74 | cmd_res = run_cmd_output(export_cmd) | 75 | cmd_res = run_cmd_output(export_cmd) |
| @@ -17,6 +17,7 @@ | |||
| 17 | # ---------------------------------------------------------------------------- | 17 | # ---------------------------------------------------------------------------- |
| 18 | 18 | ||
| 19 | import os | 19 | import os |
| 20 | +import shlex | ||
| 20 | import subprocess | 21 | import subprocess |
| 21 | from datetime import datetime, timezone | 22 | from datetime import datetime, timezone |
| 22 | 23 | ||
| @@ -85,7 +86,7 @@ class AsysProfiling(): | |||
| 85 | if not self._check_param(): | 86 | if not self._check_param(): |
| 86 | return False | 87 | return False |
| 87 | log_info(f"Run mode is {self.run_modes}.") | 88 | log_info(f"Run mode is {self.run_modes}.") |
| 88 | - cmd = (f"msprof --output={self.output_path} --sys-period={str(self.period)} " | 89 | + cmd = (f"msprof --output={shlex.quote(self.output_path)} --sys-period={str(self.period)} " |
| 89 | f"--sys-devices={self.device_id} ") | 90 | f"--sys-devices={self.device_id} ") |
| 90 | for run_mode in self.run_modes: | 91 | for run_mode in self.run_modes: |
| 91 | func_name = "concat_" + run_mode | 92 | func_name = "concat_" + run_mode |