Security: Command Injection via subprocess.Popen in Debug Restart Operator

[tomaioo]

Summary

Security: Command Injection via subprocess.Popen in Debug Restart Operator

Problem

Severity: Medium | File: operators/debug.py:L37

The LUXCORE_OT_debug_restart operator in operators/debug.py uses subprocess.Popen with bpy.app.binary_path without any sanitization or validation. While bpy.app.binary_path is typically set by Blender itself, if this value is somehow manipulated or if the code is modified to accept user input, it could lead to command injection. The operator passes arguments directly to subprocess without using a list properly separated from shell interpretation, though in this case the list format is used correctly. However, the --python-expr with inline Python is still a concern for maintainability and potential injection if any part becomes dynamic.

Solution

Validate bpy.app.binary_path exists and is a legitimate Blender executable before calling subprocess. Consider using sys.executable instead if appropriate. Avoid constructing command arguments with string formatting. If user input ever becomes involved, use strict allowlisting.

Changes

• operators/debug.py (modified)