Bug 15605 - SonarQube Finding: ToasterUI uses user input for direct command execution
Summary: SonarQube Finding: ToasterUI uses user input for direct command execution
Status: NEW
Alias: None
Product: Toaster
Classification: Build System, Metadata & Runtime
Component: toaster (show other bugs)
Version: unspecified
Hardware: x86 Multiple
: Undecided normal
Target Milestone: 0.0.0
Assignee: David Reyna
QA Contact: Toaster default assignee
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2024-10-02 12:20 UTC by David Winter
Modified: 2024-10-02 12:20 UTC (History)
0 users

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Don't know

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description David Winter 2024-10-02 12:20:23 UTC 
The code of method GitRevisionTypeAhead take git_url from user and pass directly to command execution without any further validation.

Constructing arguments of system commands from user input is security-sensitive pythonsecurity:S6350

Source Code Pointer: 
https://github.com/yoctoproject/poky/blob/master/bitbake/lib/toaster/toastergui/typeaheads.py#L185


See
OWASP Top 10 2021 Category A3 - Injection https://owasp.org/Top10/A03_2021-Injection/
OWASP Top 10 2017 Category A1 - Injection https://owasp.org/www-project-top-ten/2017/A1_2017-Injection
MITRE, CWE-88 - Argument Injection or Modification https://cwe.mitre.org/data/definitions/88
SANS Top 25 - Insecure Interaction Between Components https://www.sans.org/top25-software-errors/#cat1
CVE-2021-29472 - PHP Supply Chain Attack on Composer https://blog.sonarsource.com/php-supply-chain-attack-on-composer