Potential security issue with a possible injection

[stationeros]

We are using os.system inside install

https://github.com/intuit/Trapheus/blob/master/install.py#L17
https://github.com/intuit/Trapheus/blob/master/install.py#L44

This type of invocation is dangerous as it is vulnerable to various shell injection attacks. Great care should be taken to sanitize all input in order to mitigate this risk. Calls of this type are identified by the use of certain commands which are known to use shells.

Remediation
The subprocess module provides more powerful facilities for spawning new processes and retrieving their results; using that module is preferable to using this function.

Example of secure code:

import subprocess

subprocess.call('/bin/echo suspicious code', shell=False)

[Madhura-saw]

Could I be assigned to this issue?

[stationeros]

Sure , assigned to you