Popen([..], shell=True, [..]) can be avoided and may be exploitable (command injection)

[hartwork]

Hi!

I found this code:

pypeek/src/pypeek/main.py

Lines 1049 to 1058 in ac94d6a

	systemcall = str(self.ffmpeg_bin)+" -r " + str(self.true_fps) + " -y"
	systemcall += " -start_number " + str(start_number)
	systemcall += " -i " + str(fprefix)+"%"+str(self.fmt)+".jpg"
	systemcall += " -vframes " + str(vframes)
	systemcall += " "+self.ffmpeg_flags[self.v_ext + self.quality]
	systemcall += " "+str(vidfile)
	systemcall += " -progress pipe:1"
	try:
	process = subprocess.Popen(systemcall, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, encoding='utf-8', errors='replace')

If any of the variables going systemcall can be controlled by an attacker, then this is a command injection vulnerability.
Either way, I would resolve needless(?) shell=True here and build a list to call that command, not a flat string.

Thanks, Sebastian

[firatkiral]

@hartwork thank you, looking...

[hartwork]

@firatkiral found 870cd31 about it now, very nice, thank you! 👍