From 56c24379c7a5cbb94cf13d37b197067ea9594ab4 Mon Sep 17 00:00:00 2001
From: ndren <andreien@proton.me>
Date: Mon, 22 Jan 2024 21:18:20 +0000
Subject: [PATCH] Fix CVE-2024-0521

This uses shlex for safe command parsing to fix arbitrary code injection
---
 python/paddle/utils/download.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/python/paddle/utils/download.py b/python/paddle/utils/download.py
index b9ca1f35976c63..e1673739f90f5e 100644
--- a/python/paddle/utils/download.py
+++ b/python/paddle/utils/download.py
@@ -15,6 +15,7 @@
 import hashlib
 import os
 import os.path as osp
+import shlex
 import shutil
 import subprocess
 import sys
@@ -204,7 +205,8 @@ def _wget_download(url: str, fullname: str):
             'https',
         ), 'Only support https and http url'
         # using wget to download url
-        tmp_fullname = fullname + "_tmp"
+        tmp_fullname = shlex.quote(fullname + "_tmp")
+        url = shlex.quote(url)
         # –user-agent
         command = f'wget -O {tmp_fullname} -t {DOWNLOAD_RETRY_LIMIT} {url}'
         subprc = subprocess.Popen(