Skip to content

Commit 049eba0

Browse files
authored
Guard against empty call argument list (#1146)
Although probably uncommon, it is possible to pass an empty list to one of subprocess functions. If this is done, the injection_shell plugin raises an IndexError while checking the contents of the list argument given. The fix is to simply check for a non-empty list. Test case was also added. Fixes: #1141 Signed-off-by: Eric Brown <[email protected]>
1 parent ad56c78 commit 049eba0

File tree

3 files changed

+4
-3
lines changed

3 files changed

+4
-3
lines changed

bandit/plugins/injection_shell.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -683,7 +683,7 @@ def start_process_with_partial_path(context, config):
683683
):
684684
node = context.node.args[0]
685685
# some calls take an arg list, check the first part
686-
if isinstance(node, ast.List):
686+
if isinstance(node, ast.List) and node.elts:
687687
node = node.elts[0]
688688

689689
# make sure the param is a string literal and not a var name

examples/subprocess_shell.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ def __len__(self):
2525

2626
subprocess.check_output(['/bin/ls', '-l'])
2727
subprocess.check_output('/bin/ls -l', shell=True)
28+
subprocess.check_output([], stdout=None)
2829

2930
subprocess.getoutput('/bin/ls -l')
3031
subprocess.getstatusoutput('/bin/ls -l')

tests/functional/test_functional.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -492,8 +492,8 @@ def test_ssl_insecure_version(self):
492492
def test_subprocess_shell(self):
493493
"""Test for `subprocess.Popen` with `shell=True`."""
494494
expect = {
495-
"SEVERITY": {"UNDEFINED": 0, "LOW": 23, "MEDIUM": 1, "HIGH": 11},
496-
"CONFIDENCE": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 0, "HIGH": 34},
495+
"SEVERITY": {"UNDEFINED": 0, "LOW": 24, "MEDIUM": 1, "HIGH": 11},
496+
"CONFIDENCE": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 0, "HIGH": 35},
497497
}
498498
self.check_example("subprocess_shell.py", expect)
499499

0 commit comments

Comments
 (0)