Commit f175ba17 authored by Valentin Rothberg's avatar Valentin Rothberg Committed by Greg Kroah-Hartman

checkkconfigsymbols.py: avoid shell injection

Use subprocess and set shell to False to avoid potential shell
injections.
Reported-by: default avatarBernd Dietzel <tcpip@t-online.de>
Signed-off-by: default avatarValentin Rothberg <valentinrothberg@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4c73c088
......@@ -2,7 +2,7 @@
"""Find Kconfig symbols that are referenced but not defined."""
# (c) 2014-2015 Valentin Rothberg <valentinrothberg@gmail.com>
# (c) 2014-2016 Valentin Rothberg <valentinrothberg@gmail.com>
# (c) 2014 Stefan Hengelein <stefan.hengelein@fau.de>
#
# Licensed under the terms of the GNU GPL License version 2
......@@ -12,6 +12,7 @@ import difflib
import os
import re
import signal
import subprocess
import sys
from multiprocessing import Pool, cpu_count
from optparse import OptionParser
......@@ -222,10 +223,11 @@ def red(string):
def execute(cmd):
"""Execute %cmd and return stdout. Exit in case of error."""
pop = Popen(cmd, stdout=PIPE, stderr=STDOUT, shell=True)
(stdout, _) = pop.communicate() # wait until finished
if pop.returncode != 0:
sys.exit(stdout)
try:
cmdlist = cmd.split(" ")
stdout = subprocess.check_output(cmdlist, stderr=STDOUT, shell=False)
except subprocess.CalledProcessError as fail:
exit("Failed to execute %s\n%s" % (cmd, fail))
return stdout
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment