Merge pull request #119 from tnich/cmd_output_fix

Fixed command parsing
tnich · Apr 4, 2018 · 7adbf1b · 7adbf1b
2 parents 1b4fe14 + fe0dae3
commit 7adbf1b
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 4 deletions.
diff --git a/honssh/honeypot/honeypot-script.py b/honssh/honeypot/honeypot-script.py
@@ -29,6 +29,7 @@
 # SUCH DAMAGE.
 
 import subprocess
+import shlex
 
 from honssh.config import Config
 from honssh.utils import validation
@@ -43,8 +44,9 @@ def get_pre_auth_details(self, conn_details):
         command = '%s %s %s %s %s' % (
             self.cfg.get(['honeypot-script', 'pre-auth-script']), conn_details['peer_ip'], conn_details['local_ip'],
             conn_details['peer_port'], conn_details['local_port'])
-
-        sp = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+        args = shlex.split(command)
+
+        sp = subprocess.Popen(args, shell=False, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
         result = sp.communicate()
         if sp.returncode == 0:
             binder = result[0].split(',')
@@ -62,7 +64,8 @@ def get_post_auth_details(self, conn_details):
             self.cfg.get(['honeypot-script', 'post-auth-script']), conn_details['peer_ip'], conn_details['local_ip'],
             conn_details['peer_port'], conn_details['local_port'], conn_details['username'], conn_details['password'])
 
-        sp = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+        args = shlex.split(command)
+        sp = subprocess.Popen(args, shell=False, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
         result = sp.communicate()
         if sp.returncode == 0:
             binder = result[0].split(',')

diff --git a/honssh/output/output-app_hooks.py b/honssh/output/output-app_hooks.py
@@ -32,6 +32,7 @@
 from honssh.utils import validation
 
 import subprocess
+import shlex
 
 
 class Plugin(object):
@@ -157,5 +158,6 @@ def validate_config(self):
         return True
 
     def runCommand(self, command):
-        sp = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+        args = shlex.split(command)
+        sp = subprocess.Popen(args, shell=False, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
         sp.communicate()