← Back to branch summary

~ubuntu-branches/ubuntu/wily/bandit/wily-proposed

« back to all changes in this revision

Viewing changes to examples/wildcard-injection.py

  • Committer: Package Import Robot
  • Author(s): Dave Walker (Daviey)
  • Date: 2015-07-22 09:01:39 UTC
  • Revision ID: package-import@ubuntu.com-20150722090139-fl0nluy0x8m9ctx4
Tags: upstream-0.12.0
Import upstream version 0.12.0

Show diffs side-by-side

added added

removed removed

Lines of Context:
examples/wildcard-injection.py
 
1
import os as o
 
2
import subprocess as subp
 
3
 
 
4
# Vulnerable to wildcard injection
 
5
o.system("tar xvzf *")
 
6
o.system('chown *')
 
7
o.popen2('chmod *')
 
8
subp.Popen('chown *', shell=True)
 
9
 
 
10
# Not vulnerable to wildcard injection
 
11
subp.Popen('rsync *')
 
12
subp.Popen("chmod *")
 
13
subp.Popen(['chown', '*'])
 
14
subp.Popen(["chmod", sys.argv[1], "*"],
 
15
                 stdin=subprocess.PIPE, stdout=subprocess.PIPE)
 
16
o.spawnvp(os.P_WAIT, 'tar', ['tar', 'xvzf', '*'])