Remote code execution about pep8speaks HOT 8 CLOSED

@OrkoHunter Please look into this.

from pep8speaks.

@alanjcastonguay I feel terrible overlooking this for so long. Apologies. Do you have any fix in mind? I'd be happy to implement it.

from pep8speaks.

I think the only reasonable approach is to strictly parse the configuration file and pass through whitelisted stuff only. I am uncertain what the full set of things that should be whitelisted are, though.

from pep8speaks.

@alanjcastonguay Does it make sense to allow only the alphabets and - & = in the key? Will RCE be possible in that case either?

from pep8speaks.

@OrkoHunter maybe one part of problem is here when you merging 2 dictionary. All default configurations 'keys' are here - is there any reason to add additional dictionary keys?

from pep8speaks.

Grabbing key and value and then putting them to a list args rather than using shell=True would work.

from pep8speaks.

Anything to avoid shell=True is a plus. That was critical to this exploit.

from pep8speaks.

I've added a check that the updated dictionary will only contain the keys defined (and expected).

from pep8speaks.