Skip to content
This repository has been archived by the owner on Dec 19, 2022. It is now read-only.

Add ability to send generic cec-client commands #12

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

nashant
Copy link

@nashant nashant commented Jun 14, 2020

No description provided.

@micolous
Copy link

micolous commented Aug 1, 2021

This is a really neat idea, but this implementation adds an arbitrary code execution vulnerability:

>>> command="cec_client ';echo 'hello world';#".split(' ')
>>> os.system("echo '{}' | cec-client -s".format(" ".join(command[1:])))

hello world
0

@bkanuka
Copy link

bkanuka commented Sep 4, 2021

You can quote strings and remove the security issues by using shlex.quote

Likewise the split(" ") should probably use shlex.split instead.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants