✨ (CodeQL) Fixed finding: "Uncontrolled command line"

pixee · Jan 9, 2025 · 19f66dd · 19f66dd
1 parent 0f03acb
commit 19f66dd
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/introduction/mitre.py b/introduction/mitre.py
@@ -230,18 +230,18 @@ def mitre_lab_17(request):
     return render(request, 'mitre/mitre_lab_17.html')
 
 def command_out(command):
-    process = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    process = subprocess.Popen(command, shell=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
     return process.communicate()
 
 
 @csrf_exempt
 def mitre_lab_17_api(request):
     if request.method == "POST":
         ip = request.POST.get('ip')
-        command = "nmap " + ip 
+        command = ["nmap", ip]
         res, err = command_out(command)
         res = res.decode()
         err = err.decode()
         pattern = "STATE SERVICE.*\\n\\n"
         ports = re.findall(pattern, res,re.DOTALL)[0][14:-2].split('\n')
-        return JsonResponse({'raw_res': str(res), 'raw_err': str(err), 'ports': ports})
+        return JsonResponse({'raw_res': str(res), 'raw_err': str(err), 'ports': ports})