From 6cd1a2c71a0ff36ef9dce2ed7a21cd682c396b73 Mon Sep 17 00:00:00 2001 From: S4NKALP Date: Sat, 18 Jul 2026 14:13:11 +0545 Subject: [PATCH] fix(utils): quote kill_process args, replace subprocess which with shutil - shlex.quote() in kill_process prevents shell injection - find_binary now uses shutil.which() instead of spawning 'which' - Add shell_split() helper for environment.py - Remove inline import re from escape_markup_text --- src/utils/functions.py | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/src/utils/functions.py b/src/utils/functions.py index fe404a3..a487e7a 100644 --- a/src/utils/functions.py +++ b/src/utils/functions.py @@ -3,6 +3,8 @@ import html import json import os import re +import shlex +import shutil import subprocess import threading import time @@ -284,8 +286,6 @@ def is_special_workspace(client: dict) -> bool: def escape_markup_text(text: str) -> str: - import re - clean = re.sub(r"<[^>]+>", "", text) return html.escape(clean.replace("\n", " ")) @@ -304,7 +304,7 @@ def spawn_detached(args: list[str]) -> subprocess.Popen: def kill_process(process_name: str): - exec_shell_command_async(f"pkill {process_name}", lambda *_: None) + exec_shell_command_async(f"pkill {shlex.quote(process_name)}", lambda *_: None) def is_process_running(process_name: str) -> bool: @@ -340,14 +340,11 @@ def find_process_pid(process_name: str, timeout: float | None = None) -> list[st # Binary lookup def find_binary(name: str) -> str | None: - try: - result = subprocess.run(["which", name], capture_output=True, text=True) - return result.stdout.strip() or None - except Exception as e: - logger.warning( - f"[functions] result = subprocess.run(['which', name], capture_output=T... failed: {e}" - ) - return None + return shutil.which(name) + + +def shell_split(s: str) -> list[str]: + return shlex.split(s) # General utilities