Python to execute user input grep commands securely

Question

How do I execute linux grep using python? My current attempt is the following

    output = subprocess.run(
        "/bin/grep " + query,
        cwd=path_to_files,
        stdout = subprocess.PIPE,
        stderr = subprocess.PIPE,
        shell=True
    )

Which works. Issue however is that query can include untrusted commands (eg. if they append a semicolon in the query, they can possibly run a second command in addition to the initial grep). How could I securely accept user inputs to the grep command?

The best way is not trust user input to be safe at all. Especially with shell=True. You need to restrict the query as much as possible. And that will depend on your use-case — rdas
– rdas, Commented May 24, 2019 at 7:13
I understand that shell=True is what makes this query dangerous. If I remove shell=True, subprocess would not execute by throwing a FileNotFoundError error. I would like to give my users access to use grep on a single folder, recursively. — EndenDragon
– EndenDragon, Commented May 24, 2019 at 7:18
Remove shell=True. Use chroot jail. Maybe symlink the grep binary to the local directory to get around the FileNotFoundError — rdas
– rdas, Commented May 24, 2019 at 7:20
Where is the list of filenames to grep? Is that part of query? — Barmar
– Barmar, Commented May 24, 2019 at 7:20
Correct. The user would, for example, enter -r "pokedex" */*.html into the input. Which translate to the query variable. — EndenDragon
– EndenDragon, Commented May 24, 2019 at 7:22

iElden · Accepted Answer · 2019-05-24 08:26:46Z

1

Insead of use shell=True, you can send a list to subprocess.run.

import shlex

output = subprocess.run(
    ["/bin/grep "] + shlex.split(query),
    cwd=path_to_files,
    stdout = subprocess.PIPE,
    stderr = subprocess.PIPE
)

This code prevent using ; for shell injection.

Another problem is that the user can access all files in the system.
You can use chroot for prevent a user to go above that the given file or you can modify your code for to be able to check which file the user will open.

answered May 24, 2019 at 8:26

iElden

1,3001 gold badge15 silver badges27 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Python to execute user input grep commands securely

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related