intel-screenbot

commit 0760f9b1a39d1be4c6b746dd15a622239a009b53
parent e1354765000ffa8655b5b3b245b1c5ee1ccb2369
Author: Marcel <MTRNord@users.noreply.github.com>
Date:   Thu, 10 Nov 2016 07:59:51 +0100

Fix Security issue with shell=true
Diffstat:
M
intel_screenbot/__init__.py
 | 
8
++++----

1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/intel_screenbot/__init__.py b/intel_screenbot/__init__.py
@@ -22,11 +22,11 @@ def _screencap(url, filename, SACSID, CSRF, search):
     logger.info("screencapping {} and saving as {}".format(url, filename))
     #os.path.realpath(__file__)
     if search == False:
-        command = "phantomjs hangupsbot/plugins/intel_screenbot/screencap.js '" + SACSID + "' '" + CSRF + "' '" + url + "' '" +  filename + "'"
-        process = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE)
+        command = ['phantomjs', 'hangupsbot/plugins/intel_screenbot/screencap.js', SACSID, CSRF, url, filename]
+        process = subprocess.Popen(command, shell=False, stdout=subprocess.PIPE)
     else:
-        command = "phantomjs hangupsbot/plugins/intel_screenbot/screencap.js '" + SACSID + "' '" + CSRF + "' '" + url + "' '" +  filename + "' '" + search + "'"
-        process = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE)
+        command = ['phantomjs', 'hangupsbot/plugins/intel_screenbot/screencap.js', SACSID, CSRF, url, filename, search]
+        process = subprocess.Popen(command, shell=False, stdout=subprocess.PIPE)
 
     # make sure phantomjs has time to download/process the page
     # but if we get nothing after 30 sec, just move on