15605 2024-10-02 12:20:23 +0000 SonarQube Finding: ToasterUI uses user input for direct command execution 2024-10-02 12:20:23 +0000 1 1 7 Build System, Metadata & Runtime Toaster toaster unspecified x86 Multiple NEW Undecided normal 0.0.0 1 DAWINTER david.reyna toaster --- --- Don't know oldest_to_newest 99751 0 DAWINTER 2024-10-02 12:20:23 +0000 The code of method GitRevisionTypeAhead take git_url from user and pass directly to command execution without any further validation. Constructing arguments of system commands from user input is security-sensitive pythonsecurity:S6350 Source Code Pointer: https://github.com/yoctoproject/poky/blob/master/bitbake/lib/toaster/toastergui/typeaheads.py#L185 See OWASP Top 10 2021 Category A3 - Injection https://owasp.org/Top10/A03_2021-Injection/ OWASP Top 10 2017 Category A1 - Injection https://owasp.org/www-project-top-ten/2017/A1_2017-Injection MITRE, CWE-88 - Argument Injection or Modification https://cwe.mitre.org/data/definitions/88 SANS Top 25 - Insecure Interaction Between Components https://www.sans.org/top25-software-errors/#cat1 CVE-2021-29472 - PHP Supply Chain Attack on Composer https://blog.sonarsource.com/php-supply-chain-attack-on-composer