OS command injection (ARCH2102)

Key python.security.os-command-injection · Severity error · Category security · CWE CWE-78

Building a command string from untrusted input or running it with shell=True lets an attacker execute arbitrary commands. Pass arguments as a list.

Incorrect

import subprocess

def ping(host):
    subprocess.run("ping -c 1 " + host, shell=True)

Correct

import subprocess

def ping(host):
    subprocess.run(["ping", "-c", "1", host], shell=False)

Fix

Avoid shell=True; pass the command and arguments as a list and validate the input.