kevinheyer/bootstrap-vz
1
0
Fork 0
mirror of https://github.com/kevingruesser/bootstrap-vz.git synced 2025-08-24 07:26:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix unfailing CheckExternalCommands

Browse source 
On Unix, with shell=True, the shell default to /bin/sh.
Using Popen(['type', command], shell=True) is equivalent to calling
Popen(['/bin/sh', '-c', 'type', command]).
In this case 'command' becomes a positional parameter to the shell,
and not an argument to the command 'type'.

The solution is to pass a single string as parameter.

The problem is that with shell=True, we are never safe from a shell injection,
so it is wiser to use a python only solution.

The package distutils is part of the standard distribution, so it doesn't add
extra dependencies.
The method find_executable has the same behaviour as 'which' on bash.
This commit is contained in:
Brendan Harley 2017-05-26 04:20:56 +02:00
parent 0fa83961b8
commit df3a200df3
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
bootstrapvz/common/tasks/host.py
View file

@ -9,14 +9,14 @@ class CheckExternalCommands(Task):
@classmethod @classmethod
def run(cls, info): def run(cls, info):
from ..tools import log_check_call
from subprocess import CalledProcessError
import re import re
import logging
from distutils.spawn import find_executable
missing_packages = [] missing_packages = []
log = logging.getLogger(__name__)
for command, package in info.host_dependencies.items(): for command, package in info.host_dependencies.items():
try: log.debug('Checking availability of ' + command)
log_check_call(['type', command], shell=True) if find_executable(command) is None:
except CalledProcessError:
if re.match('^https?:\/\/', package): if re.match('^https?:\/\/', package):
msg = ('The command `{command}\' is not available, ' msg = ('The command `{command}\' is not available, '
'you can download the software at `{package}\'.' 'you can download the software at `{package}\'.'