From 25d0af03b84e2ea558a035d878e8d22fafa71ab4 Mon Sep 17 00:00:00 2001 From: Nguyen Cong Vinh <80946737+vn-ncvinh@users.noreply.github.com> Date: Wed, 24 Jan 2024 15:15:49 +0700 Subject: [PATCH 1/2] Fix OS Command Injection --- python/paddle/utils/download.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/python/paddle/utils/download.py b/python/paddle/utils/download.py index b9ca1f35976c63..0ee540e565d838 100644 --- a/python/paddle/utils/download.py +++ b/python/paddle/utils/download.py @@ -206,9 +206,9 @@ def _wget_download(url: str, fullname: str): # using wget to download url tmp_fullname = fullname + "_tmp" # –user-agent - command = f'wget -O {tmp_fullname} -t {DOWNLOAD_RETRY_LIMIT} {url}' + command = ['wget', '-O', tmp_fullname, '-t', str(DOWNLOAD_RETRY_LIMIT), url] subprc = subprocess.Popen( - command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE + command, stdout=subprocess.PIPE, stderr=subprocess.PIPE ) _ = subprc.communicate() From b06007f84d5ca7e7292a0121dd3062f2150e6842 Mon Sep 17 00:00:00 2001 From: Nguyen Cong Vinh <80946737+vn-ncvinh@users.noreply.github.com> Date: Tue, 30 Jan 2024 10:13:24 +0700 Subject: [PATCH 2/2] Fix CodeStyle --- python/paddle/utils/download.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/python/paddle/utils/download.py b/python/paddle/utils/download.py index 0ee540e565d838..9b7b40fc2a47a4 100644 --- a/python/paddle/utils/download.py +++ b/python/paddle/utils/download.py @@ -206,7 +206,14 @@ def _wget_download(url: str, fullname: str): # using wget to download url tmp_fullname = fullname + "_tmp" # –user-agent - command = ['wget', '-O', tmp_fullname, '-t', str(DOWNLOAD_RETRY_LIMIT), url] + command = [ + 'wget', + '-O', + tmp_fullname, + '-t', + str(DOWNLOAD_RETRY_LIMIT), + url, + ] subprc = subprocess.Popen( command, stdout=subprocess.PIPE, stderr=subprocess.PIPE )