mirrors/github.com_openSUSE_osc
1
0
Fork 0
mirror of https://github.com/openSUSE/osc.git synced 2025-01-12 00:46:14 +01:00
Code

Remove no longer valid warning from core.unpack_srcrpm()

Browse Source 
Shell injection is not possible with Popen() which has shell=False as a default.
This commit is contained in:
Daniel Mach 2024-05-28 09:04:56 +02:00
parent e981645791
commit a3ed68508b
1 changed files with 0 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
osc/core.py
View File

@ -5181,8 +5181,6 @@ def unpack_srcrpm(srpm, dir, *files):
with open(os.devnull, 'w') as devnull:
rpm2cpio_proc = subprocess.Popen(['rpm2cpio'], stdin=fsrpm,
stdout=subprocess.PIPE)
# XXX: shell injection is possible via the files parameter, but the
# current osc code does not use the files parameter.
cpio_proc = subprocess.Popen(['cpio', '-i'] + list(files),
stdin=rpm2cpio_proc.stdout,
stderr=devnull)