fly316/PX4-Autopilot
7
0
Fork 0
mirror of https://gitee.com/mirrors_PX4/PX4-Autopilot.git synced 2026-04-14 10:07:39 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(tools): prevent command injection in px_mkfw.py (#26678)

Browse Source 
* fix(tools): prevent command injection in px_mkfw.py

* copilot review: only capture stdout
This commit is contained in:
Jacob Dahl 2026-03-06 14:23:20 -09:00 committed by GitHub
parent ec56d2d83b
commit 343fd01e19
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
Tools/px_mkfw.py
View File

@ -42,6 +42,7 @@
import argparse import argparse
import json import json
import base64 import base64
import os
import zlib import zlib
import time import time
import subprocess import subprocess
@ -99,14 +100,13 @@ if args.summary != None:
if args.description != None: if args.description != None:
desc['description'] = str(args.description) desc['description'] = str(args.description)
if args.git_identity != None: if args.git_identity != None:
cmd = "git --git-dir '{:}/.git' describe --exclude ext/* --always --tags".format(args.git_identity) git_dir = os.path.join(args.git_identity, '.git')
p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE).stdout p = subprocess.run(["git", "--git-dir", git_dir, "describe", "--exclude", "ext/*", "--always", "--tags"],
desc['git_identity'] = p.read().strip().decode('utf-8') stdout=subprocess.PIPE, text=True)
p.close() desc['git_identity'] = p.stdout.strip()
cmd = "git --git-dir '{:}/.git' rev-parse --verify HEAD".format(args.git_identity) p = subprocess.run(["git", "--git-dir", git_dir, "rev-parse", "--verify", "HEAD"],
p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE).stdout stdout=subprocess.PIPE, text=True)
desc['git_hash'] = p.read().strip().decode('utf-8') desc['git_hash'] = p.stdout.strip()
p.close()
if args.parameter_xml != None: if args.parameter_xml != None:
f = open(args.parameter_xml, "rb") f = open(args.parameter_xml, "rb")
bytes = f.read() bytes = f.read()