Skip to content

Commit 20678c3

Browse files
[SECURITY] Fix unsafe subprocess invocation in Phunter integration (intelowlproject#3464)
* Refactor: Pass subprocess command arguments as a list directly to improve execution. * chore: Add license header and remove unused `shlex` import. * fix(phunter): use absolute path for python executable to satisfy security linter
1 parent d81c62c commit 20678c3

1 file changed

Lines changed: 3 additions & 4 deletions

File tree

integrations/phunter/app.py

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1+
# This file is a part of IntelOwl https://github.com/intelowlproject/IntelOwl
2+
# See the file 'LICENSE' for copying permission.
13
import logging
24
import re
3-
import shlex
45
import subprocess
56

67
from flask import Flask, jsonify, request
@@ -69,10 +70,8 @@ def analyze():
6970

7071
try:
7172
logger.info("Executing Phunter CLI tool")
72-
command_str = f"python3 phunter.py -t {phone_number}"
73-
command = shlex.split(command_str)
7473
result = subprocess.run(
75-
command,
74+
["/usr/bin/python3", "phunter.py", "-t", str(phone_number)],
7675
capture_output=True,
7776
text=True,
7877
check=True,

0 commit comments

Comments
 (0)