Fixed a flaw regarding subprocess calls

[Kondent]

Related issue
#2330

Description

• Wazuh main issue: Investigate possible vulnerabilities when using subprocess in the framework/ directory wazuh#10144.
• Wazuh main PR: Remove execute method from core/utils.py since it is not being used wazuh#10740.
• Flaw status:
  • B603:
    • wazuh/framework/wazuh/core/cluster/cluster.py: FALSE POSITIVE
    • wazuh/framework/wazuh/core/common.py: FALSE POSITIVE
    • wazuh/framework/wazuh/core/configuration.py: FALSE POSITIVE
    • wazuh/framework/scripts/wazuh-logtest.py: FALSE POSITIVE
    • wazuh/framework/wazuh/core/utils.py: FIXED
  • B404:
    • wazuh/framework/scripts/wazuh-logtest.py: FALSE POSITIVE
    • wazuh/framework/wazuh/core/cluster/cluster.py: FALSE POSITIVE
    • wazuh/framework/wazuh/core/common.py: FALSE POSITIVE
    • wazuh/framework/wazuh/core/configuration.py: FALSE POSITIVE

Under this development, the related possible code flaw is set as solved using Code Analysis Tool.

Tests

• Proven that tests pass when they have to pass.
• Proven that tests fail when they have to fail.

[mcarmona99]

LGTM

[Rebits]

27/12/21

	Report
R1	🔴
R2	🔴
R3	🔴

Where new flaws are

{
    "new_flaws": [
        {
            "code": " from shutil import rmtree\n from subprocess import check_output\n from time import time\n",
            "filename": "framework/wazuh/core/cluster/cluster.py",
            "issue_confidence": "HIGH",
            "issue_severity": "LOW",
            "issue_text": "Consider possible security implications associated with check_output module.",
            "line_number": 15,
            "line_range": [
                15
            ],
            "more_info": "https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b404-import-subprocess",
            "test_id": "B404",
            "test_name": "blacklist"
        },
        {
            "code": "     \"\"\"\n     return set(str(check_output(['hostname', '--all-ip-addresses']).decode()).split(\" \")[:-1])\n \n",
            "filename": "framework/wazuh/core/cluster/cluster.py",
            "issue_confidence": "HIGH",
            "issue_severity": "LOW",
            "issue_text": "Starting a process with a partial executable path",
            "line_number": 42,
            "line_range": [
                42
            ],
            "more_info": "https://bandit.readthedocs.io/en/latest/plugins/b607_start_process_with_partial_path.html",
            "test_id": "B607",
            "test_name": "start_process_with_partial_path"
        },
        {
            "code": "     \"\"\"\n     return set(str(check_output(['hostname', '--all-ip-addresses']).decode()).split(\" \")[:-1])\n \n",
            "filename": "framework/wazuh/core/cluster/cluster.py",
            "issue_confidence": "HIGH",
            "issue_severity": "LOW",
            "issue_text": "subprocess call - check for execution of untrusted input.",
            "line_number": 42,
            "line_range": [
                42
            ],
            "more_info": "https://bandit.readthedocs.io/en/latest/plugins/b603_subprocess_without_shell_equals_true.html",
            "test_id": "B603",
            "test_name": "subprocess_without_shell_equals_true"
        }
    ]
}

These are solved at dev-fix-python-code-vulnerabilities branch.

[Rebits]

LGTM