STay545575 (Community Member) asked a question.
How to solve OS Command Injection flaw (CWE ID 78) for subprocess popen
Hello All,
Our veracode scans detected a OS Command Injection flaw (CWE ID 78) on the following python code:
def runCommand(arguments_list):
...
proc = subprocess.Popen(arguments_list, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
...
Would like to ask our esteemed community here if anyone has resolved this specific problem for Python code before?
Thank you, in advance.
.png){kind=logo}
Thank you for helping out.
Would you have examples of how to to properly sanitize and validate the input?
More details would greatly help.
Hi @STay545575 (Community Member) ,
I will need a bit more context for to reply. I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
Please ensure that you include in your case:
Thank you,
Boy Baukema
Thank you Boy - have raised a case as you suggested.
Hi @Boy, Security Consultant (Veracode) and Veracode Support Team,
I have opened Case 00716859 on 2Aug but wasn't able to get a reply from your team.
May I have your help to take a look at this Case please?
Thank you.
Hi @STay545575 (Community Member) ,
I'm sorry I did not reply earlier, unfortunately there is an issue with Community emails that we're waiting on Engineering to resolve.
I noticed you received a reply from my colleague @vnhin (Veracode, Inc.) and the case is currently waiting your reply.
Please feel free to keep me in the loop: bbaukema@veracode.com .
Thank you,
Boy Baukema