Skip to content

Draft: fix: resolve command injection vulnerability

Duo Developerrequested to merge
workloads/89aa530f750 into main

Relates to issue #31

This MR was created by Duo in Session 1201290

Changes

  • Remove vulnerable shell=True parameter from subprocess calls in admin login route
  • Replace string-based command construction with secure argument list approach
  • Implement proper input sanitization while maintaining educational vulnerability demo
  • Ensure SonarQube rule pythonsecurity:S2076 no longer triggers
  • Maintain existing functionality and test compatibility

Merge request reports