[makeotf] prevent bash and python code execution #877
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
josh-hadley
force-pushed
the
jh-fix-makeotf-bash-code-exec
branch
from
3c88641
to
493b528
Compare
miguelsousa
reviewed
Aug 1, 2019
miguelsousa
reviewed
Aug 2, 2019
python/afdko/makeotf.py
Outdated
|
|
||
| fdkutils.runShellCmdLogging(commandString) | ||
| success = fdkutils.run_shell_command(params, suppress_output=True) |
There was a problem hiding this comment.
On a closer look, the output cannot be suppressed because it suppresses all the errors and warnings issued by makeotfexe. Run this for example:
makeotf -f makeotf_data/input/cidfont.ps
This is why I wanted to run a few commands first; the test suite doesn't tell the full story.
- new routines do not set `shell=True` - several updates related to command handling differences (list of strings vs single string, int vs string args) - updated a few test cases related to command result differences (ints vs strings)
- don't use `eval()` - use `.isnumeric()` rather than `try`/`except`
returns head.fontRevision value from supplied font_path
- add `suppress_output` option to `run_shell_command()` to prevent unexpected blank lines in captured output - update version #
- use `run_shell_command` instead of discarding output of `get_shell_command_output` - update version #
…he console messages
miguelsousa
force-pushed
the
jh-fix-makeotf-bash-code-exec
branch
from
30c9d36
to
a515254
Compare
miguelsousa
approved these changes
Aug 2, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
subprocesswithshell=Truewhich allows shell code execution (closes [makeotf] bash code in style name is executed #780 )eval()andexec()which allow Python code execution