mirror of
https://git.yoctoproject.org/poky
synced 2026-10-15 04:57:15 +00:00
Richard Purdie
3df97be56e
Using bash to handle execution parameters isn't a great idea, particularly using os.system. In theory this could be exploited by injecting shell code through the placeholders although whether this can be done without security tokens is unclear. Regardless, we have been cleaning up shell=True and similar calls in the codebase. Instead use shlex to parse the callback command, then we can iterate the parameters to perform any expansions needed and avoid the need to call any shell expansion. Any invalid data will then just become an invalid image target to bitbake. Reported-by: Lei Zhang <18792670849@163.com> (Bitbake rev: d3b32587c2314febf96897f97e0172790b4fc1cf) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Paul Barker <paul@pbarker.dev>