Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Avoid shell injection problems by using subprocess.run() #95

Closed
wants to merge 2 commits into from
Closed

Avoid shell injection problems by using subprocess.run() #95

wants to merge 2 commits into from

Commits on Nov 20, 2020

  1. Drop run_shell_command in favour of subprocess.run 

    run_shell_command was parsing the command line passed, so it was subject to shell injections
and, on Windows, wouldn't handle filenames correctly -- it would split on spaces (which are common
in Windows filenames) and interpret \s (also common in Windows file names) as control codes.

To do this, I got rid of defaceTpl, which was a shell command template, in favour of hardcoding
pydeface as the anonymizing algorithm, and as a result of that I also bumped the major version.
    @kousu
    kousu committed Nov 20, 2020
    Configuration menu
    Copy the full SHA
    18ba2de View commit details
    Browse the repository at this point in the history

  2. Make pydeface a requirement. 

    Also, remove the layer of indirection of putting the requirements outside of setup.py.
    @kousu
    kousu committed Nov 20, 2020
    Configuration menu
    Copy the full SHA
    bf9003d View commit details
    Browse the repository at this point in the history