4 ms·

Can someone explain for those of us who aren't as savvy?

• tecleandor 2y ago
  I know just a little bit of python and that looks like it does what the description says. Maybe I wouldn't use subprocess but do it via the standard lib. What should we be looking for in the code?
  • craigds 2y ago
    shell=True is a security risk unless you're very careful with escaping inputs. In this case any filename with a `;` in it (or various other shell characters) will run arbitrary commands on the attacker's computer. best to pass a list of arguments to subprocess rather than a string, and avoid shell=True
    • sandreas 2y ago
      I never understood why there even is an api for using a string... Same for SQL statements, single quotes in a query string should generate a warning to just use prepared statements instead :-)
    • tecleandor 2y ago
      Ah true! I fixated on exactly the line that was marked. I guess it's not that bad because you're choosing the file to copy, but I wouldn't have used a subshell for copying a file anyway.
• tapanih 2y ago
  With a well-crafted filename, you can run arbitrary commands on the attackers computer.