Bug 15605

Summary: SonarQube Finding: ToasterUI uses user input for direct command execution
Product: [Build System, Metadata & Runtime] Toaster Reporter: David Winter <DAWINTER>
Component: toasterAssignee: David Reyna <david.reyna>
Status: NEW --- QA Contact: Toaster default assignee <toaster>
Severity: normal    
Priority: Undecided    
Version: unspecified   
Target Milestone: 0.0.0   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: Don't know

Description David Winter 2024-10-02 12:20:23 UTC 
The code of method GitRevisionTypeAhead take git_url from user and pass directly to command execution without any further validation.

Constructing arguments of system commands from user input is security-sensitive pythonsecurity:S6350

Source Code Pointer: 
https://github.com/yoctoproject/poky/blob/master/bitbake/lib/toaster/toastergui/typeaheads.py#L185


See
OWASP Top 10 2021 Category A3 - Injection https://owasp.org/Top10/A03_2021-Injection/
OWASP Top 10 2017 Category A1 - Injection https://owasp.org/www-project-top-ten/2017/A1_2017-Injection
MITRE, CWE-88 - Argument Injection or Modification https://cwe.mitre.org/data/definitions/88
SANS Top 25 - Insecure Interaction Between Components https://www.sans.org/top25-software-errors/#cat1
CVE-2021-29472 - PHP Supply Chain Attack on Composer https://blog.sonarsource.com/php-supply-chain-attack-on-composer