[IMP] Improve poppler subprocess security

bosd · bosd · commit 7ea668f45e7b · 2024-10-06T10:26:13.000+02:00
diff --git a/camelot/backends/poppler_backend.py b/camelot/backends/poppler_backend.py
@@ -19,7 +19,7 @@ def convert(self, pdf_path, png_path):
 
         try:
             subprocess.check_output(
-                " ".join(pdftopng_command), stderr=subprocess.STDOUT, shell=True
+                " ".join(pdftopng_command), stderr=subprocess.STDOUT, shell=False
             )
         except subprocess.CalledProcessError as e:
             raise ValueError(e.output)

Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ def convert(self, pdf_path, png_path):`
`19`	`19`
`20`	`20`	`try:`
`21`	`21`	`subprocess.check_output(`
`22`		`- " ".join(pdftopng_command), stderr=subprocess.STDOUT, shell=True`
	`22`	`+ " ".join(pdftopng_command), stderr=subprocess.STDOUT, shell=False`
`23`	`23`	`)`
`24`	`24`	`except subprocess.CalledProcessError as e:`
`25`	`25`	`raise ValueError(e.output)`