Risk handling with shell=True

avocado-framework · Jun 28, 2024 · 4b8191e · 4b8191e
1 parent 320eba3
commit 4b8191e
Showing 1 changed file with 5 additions and 5 deletions.
diff --git a/avocado/utils/network/interfaces.py b/avocado/utils/network/interfaces.py
@@ -802,10 +802,9 @@ def ping_flood(self, int_name, peer_ip, ping_count):
                   returns False on ping flood failure.
         :rtype: boolean
         """
-        cmd = f"ping -I {int_name} {peer_ip} -c {ping_count} -f "
+        cmd = ["ping", "-I", str(int_name), str(peer_ip), "-c", str(ping_count), "-f"]
         ping_process = subprocess.Popen(
             cmd,
-            shell=True,
             stdout=subprocess.PIPE,
             stderr=subprocess.STDOUT,
             universal_newlines=True,
@@ -819,9 +818,10 @@ def ping_flood(self, int_name, peer_ip, ping_count):
                 msg = "ping flood failed to remote machine, Please check the logs"
                 LOG.debug(msg)
                 return False
-            return True
+            break
         ping_process.stdout.close()
         ping_process.wait()
+        return True
 
     def get_device_IPI_name(self):
         """
@@ -839,11 +839,11 @@ def get_device_IPI_name(self):
                 f"awk -F/ '{{print $3}}'"
             )
             interface_type = process.system_output(
-                cmd, shell=True, ignore_status=True
+                cmd, ignore_status=True
             ).decode("utf-8")
             cmd = f"echo {interface_type} | sed 's/@/-/' "
             interface_type = process.system_output(
-                cmd, shell=True, ignore_status=True
+                cmd, ignore_status=True
             ).decode("utf-8")
             return interface_type
         elif self.is_veth():