Commit f175ba17 authored by Valentin Rothberg's avatar Valentin Rothberg Committed by Greg Kroah-Hartman
Browse files

checkkconfigsymbols.py: avoid shell injection



Use subprocess and set shell to False to avoid potential shell
injections.

Reported-by: default avatarBernd Dietzel <tcpip@t-online.de>
Signed-off-by: default avatarValentin Rothberg <valentinrothberg@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4c73c088
Loading
Loading
Loading
Loading
+7 −5
Original line number Diff line number Diff line
@@ -2,7 +2,7 @@

"""Find Kconfig symbols that are referenced but not defined."""

# (c) 2014-2015 Valentin Rothberg <valentinrothberg@gmail.com>
# (c) 2014-2016 Valentin Rothberg <valentinrothberg@gmail.com>
# (c) 2014 Stefan Hengelein <stefan.hengelein@fau.de>
#
# Licensed under the terms of the GNU GPL License version 2
@@ -12,6 +12,7 @@ import difflib
import os
import re
import signal
import subprocess
import sys
from multiprocessing import Pool, cpu_count
from optparse import OptionParser
@@ -222,10 +223,11 @@ def red(string):

def execute(cmd):
    """Execute %cmd and return stdout.  Exit in case of error."""
    pop = Popen(cmd, stdout=PIPE, stderr=STDOUT, shell=True)
    (stdout, _) = pop.communicate()  # wait until finished
    if pop.returncode != 0:
        sys.exit(stdout)
    try:
        cmdlist = cmd.split(" ")
        stdout = subprocess.check_output(cmdlist, stderr=STDOUT, shell=False)
    except subprocess.CalledProcessError as fail:
        exit("Failed to execute %s\n%s" % (cmd, fail))
    return stdout