Skip to content

⚠️ SECURITY-#203: Remove shell injection vulnerability in write_file_system#213

Merged
FernandoCelmer merged 1 commit intodevelopfrom
feature/203
Apr 8, 2026
Merged

⚠️ SECURITY-#203: Remove shell injection vulnerability in write_file_system#213
FernandoCelmer merged 1 commit intodevelopfrom
feature/203

Conversation

@FernandoCelmer
Copy link
Copy Markdown
Member

Description

Remove write_file_system function that used os.system() with unsanitized string interpolation, enabling arbitrary command execution (RCE).

Issue: 📌 ISSUE-#203

Changes

  • Remove write_file_system from dotflow/utils/tools.py
  • Remove from os import system import
  • Update tests to use write_file (safe open() based alternative)

Type of change

  • Bug fix (non-breaking change which fixes an issue)

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my code
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes

@FernandoCelmer FernandoCelmer added security bug Something isn't working labels Apr 8, 2026
@FernandoCelmer FernandoCelmer merged commit e4fb7eb into develop Apr 8, 2026
10 checks passed
@FernandoCelmer FernandoCelmer deleted the feature/203 branch April 8, 2026 22:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working security

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant