Security audit - B411

[nicolargo]

Description

bandit -r glances/

---

Issue: [B411:blacklist] Using Fault to parse untrusted XML data is known to be vulnerable to XML attacks. Use defused.xmlrpc.monkey_patch() function to monkey-patch xmlrpclib and mitigate XML vulnerabilities.
Severity: High Confidence: High
Location: glances/compat.py:91
90 from SimpleXMLRPCServer import SimpleXMLRPCRequestHandler, SimpleXMLRPCServer
91 from xmlrpclib import Fault, ProtocolError, ServerProxy, Transport
92 from urllib2 import urlopen, URLError

Versions

• Glances (glances -V): 2.8.1

[nicolargo]

First idea, do not use the shell=True option. split the command line

In [1]: from subprocess import Popen
In [6]: cmd = 'cat README.rst | grep glances | wc -l > /tmp/titi.txt'

In [7]: Popen(cmd, shell=True)
Out[7]: <subprocess.Popen at 0x7f8b46c8c310>

In [13]: cmd_pipe = [c.split('>')[0] for c in cmd.split('|')]

In [14]: cmd_pipe
Out[14]: ['cat README.rst ', ' grep glances ', ' wc -l ']

In [15]: cmd_redir = cmd.split('>')[1]

In [16]: cmd_redir
Out[16]: ' /tmp/titi.txt'

and uses stdout for redirection:

with open('temp.txt', 'w') as output:
    server = subprocess.Popen('./server.py', stdout=output)
    server.communicate()

and this for pipe:

output=`dmesg | grep hda`
p1 = Popen(["dmesg"], stdout=PIPE)
p2 = Popen(["grep", "hda"], stdin=p1.stdout, stdout=PIPE)
p1.stdout.close()  # Allow p1 to receive a SIGPIPE if p2 exits.
output = p2.communicate()[0]