You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If environment variable values being injected contain special characters, notably any of ", ', \, and probably more, shlex gets very confused when we attempt to split the command after injection.
The current flow is:
Inject values
shlex.split
shlex.quote
I think that the correct approach here might simply be to:
Since we're explicitly not passing the command to the shell in the subprocess.run execution, we probably do not need to shlex.quote the values. Test this and make sure; if we don't need to, don't.
If environment variable values being injected contain special characters, notably any of
"
,'
,\
, and probably more,shlex
gets very confused when we attempt to split the command after injection.The current flow is:
shlex.split
shlex.quote
I think that the correct approach here might simply be to:
shlex.split
(keeping Add Windows testing and validate command processing #5 in mind)shlex.quote
The text was updated successfully, but these errors were encountered: