From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755144AbcH0JAg (ORCPT ); Sat, 27 Aug 2016 05:00:36 -0400 Received: from mail-wm0-f68.google.com ([74.125.82.68]:35873 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753466AbcH0JAd (ORCPT ); Sat, 27 Aug 2016 05:00:33 -0400 From: Valentin Rothberg To: gregkh@linuxfoundation.org, tcpip@t-online.de Cc: linux-kernel@vger.kernel.org, Valentin Rothberg Subject: [PATCH] checkkconfigsymbols.py: avoid shell injection Date: Sat, 27 Aug 2016 10:59:07 +0200 Message-Id: <20160827085907.61796-1-valentinrothberg@gmail.com> X-Mailer: git-send-email 2.9.3 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Use subprocess and set shell to False to avoid potential shell injections. Reported-by: Bernd Dietzel Signed-off-by: Valentin Rothberg --- Note that I don't see how it could be exploited currently. There is no user input used in the execute() function. I see the patch more as a preventive fix than something urgent. scripts/checkkconfigsymbols.py | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/scripts/checkkconfigsymbols.py b/scripts/checkkconfigsymbols.py index b140fc9018b1..0cae73b5c925 100755 --- a/scripts/checkkconfigsymbols.py +++ b/scripts/checkkconfigsymbols.py @@ -2,7 +2,7 @@ """Find Kconfig symbols that are referenced but not defined.""" -# (c) 2014-2015 Valentin Rothberg +# (c) 2014-2016 Valentin Rothberg # (c) 2014 Stefan Hengelein # # Licensed under the terms of the GNU GPL License version 2 @@ -12,6 +12,7 @@ import difflib import os import re import signal +import subprocess import sys from multiprocessing import Pool, cpu_count from optparse import OptionParser @@ -222,10 +223,11 @@ def red(string): def execute(cmd): """Execute %cmd and return stdout. Exit in case of error.""" - pop = Popen(cmd, stdout=PIPE, stderr=STDOUT, shell=True) - (stdout, _) = pop.communicate() # wait until finished - if pop.returncode != 0: - sys.exit(stdout) + try: + cmdlist = cmd.split(" ") + stdout = subprocess.check_output(cmdlist, stderr=STDOUT, shell=False) + except subprocess.CalledProcessError as fail: + exit("Failed to execute %s\n%s" % (cmd, fail)) return stdout -- 2.9.3