Repository navigation
command-injection: pin four decided cases of #208 in tests #219
Description
Problem
Four calls behave as decided in #208 (checked in review of #217) but are not pinned by tests/test_command_arguments.py, so a later change could alter them unnoticed:
| Call | Expected |
|---|---|
subprocess.run(["pwsh", "-command", "&", x]) |
high, vulnerability (every element after -command is the command) |
subprocess.run(["pwsh", "-Command", "Get-Item", x]) |
high, vulnerability |
subprocess.run(["node", "-pe", "CODE", f"v{x}"]) |
refuted (an argument of the code, behind a constant prefix) |
subprocess.run(["pwsh", "-File", "s.ps1", x]) |
medium, vulnerability (an argument of the script) |
Expected
Add the four cases to the parametrised table of tests/test_command_arguments.py (a new-test change only; no existing assertion changes).
Activity
Merge pull request #227 from CoreTrace/test/pin-command-cases-219