Security: Fix command injection in RepoParser.rebuild_class_views

[anxovatomica]

Summary

Fixes a command injection vulnerability in metagpt/repo_parser.py where subprocess.run() was called with shell=True on a dynamically constructed command string.

Vulnerability Details

The rebuild_class_views() method constructs a command via f-string:

command = f"pyreverse {str(path)} -o dot"
result = subprocess.run(command, shell=True, check=True, cwd=str(output_dir))

An attacker who controls the path parameter (e.g., via RepoParser.rebuild_class_views("/path; rm -rf /")) can inject arbitrary shell commands.

Fix

Replace shell=True with shell=False and pass the command as a list:

command = ["pyreverse", str(path), "-o", "dot"]
result = subprocess.run(command, shell=False, check=True, cwd=str(output_dir))

This prevents shell interpretation of the path argument.

Impact

• Severity: High
• Category: Command Injection (CWE-78)