CODEWITHSUNDEEP
python-3.xsecuritysanitization
user10273947
user10273947

Reputation:

Python3 - sanitizing user input passed to shell as parameter

What is the recommended method of sanitizing user_input_parameter passed to the shell like

subprocess.Popen(['sudo', 'rm -rf', user_input_parameter])

The command should accept all parameters but malicious activies like breaking out of the command should be mitigated.

Upvotes: 2

Views: 6197

Answers (1)

lukash
lukash

Reputation: 784

Python's implementation of subprocess protects against shell injection, documentation says so:

17.5.2. Security Considerations

Unlike some other popen functions, this implementation will never implicitly call a system shell. This means that all characters, including shell metacharacters, can safely be passed to child processes. If the shell is invoked explicitly, via shell=True, it is the application’s responsibility to ensure that all whitespace and metacharacters are quoted appropriately to avoid shell injection vulnerabilities.

When using shell=True, the shlex.quote() function can be used to properly escape whitespace and shell metacharacters in strings that are going to be used to construct shell commands.

This will however NOT protect against a user passing a malicious input - in your case for example deleting something that was not intended to be deleted. I would not pass user input to the command directly like that - you should verify if whatever you want to be deleted is being deleted and not something completely different. That is however part of application's logic already - regarding shell injection (breaking out of the command) - that should be fine with subprocess.

I made this little example:

#!/usr/bin/env python3

import subprocess

user_input_parameter = '/; id'
subprocess.Popen(['ls', user_input_parameter])

Which outputs this when executed:

$ python3 asdf.py
ls: /; id: No such file or directory
$

To demonstrate subprocess passes the input as an argument to the parameter.

All of this is true only if shell=False (default as of writing this answer) for subprocess methods, otherwise you basically enable shell (bash, etc.) execution and allow for injection to happen if inputs are not properly sanitized.

Btw, you need to pass each parameter separately, so you would need to run it like this (but please don't do that):

subprocess.Popen(['sudo', 'rm', '-rf', user_input_parameter])

Upvotes: 4

Related Questions