Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Search: unsafe use of subprocesses & curl #1471

Closed
amplifi opened this issue May 5, 2017 · 1 comment
Closed

Search: unsafe use of subprocesses & curl #1471

amplifi opened this issue May 5, 2017 · 1 comment

Comments

@amplifi
Copy link
Contributor

amplifi commented May 5, 2017

Both search and search exports spawn subprocesses to execute curl. In search export, there's no explicit timeout applied to either the curl or the subprocess itself, no return code check, etc. These uses of subprocess.run() and curl should be replaced with a safer mechanism that properly handles the calls and results/cleanup; plenty of formal options exist for implementing the two use cases with a lower level of risk).

@seav
Copy link
Contributor

seav commented Jun 10, 2017

Since the search export feature has been removed, and if we put it back it should be an asynchronous process by then, I think we can close this issue.

@seav seav closed this as completed Jun 10, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants