Prevent OS Command Injection in cmd_lab View

[pixee-integration-test]

Pixee Scan: 1870f3a5-f3b9-4f7c-b41a-6d920a86b611

Confidence: HIGH

Fix confidence is a rating derived from an internal benchmark and includes High, Medium, and Low confidence fixes. It comprises three weighted scores reflecting the safety, effectiveness and cleanliness of Pixee's code changes within a fix. View Details in Pixee.

---

Remediation

This change fixes finding AZVdjxO-h0BHfERFoIIK.

Details

Prevent OS Command Injection in cmd_lab View

Summary

Removed OS command injection in introduction/views.py's cmd_lab view by validating the domain and avoiding shell-based command construction.

Vulnerability Description

OS Command Injection happens when an application passes attacker-controlled data to a shell interpreter without strict validation. Because the shell treats metacharacters and separators as executable syntax, an attacker can append or alter commands instead of supplying only the intended argument. This can lead to arbitrary command execution with the application's privileges, data theft, file tampering, or broader system compromise.

Changes Made

The cmd_lab view in introduction/views.py previously built nslookup or dig commands directly from request.POST['domain'] and executed them with subprocess.Popen, which made shell injection possible if the input contained malicious characters. The fix normalized the submitted domain, stripped scheme and www prefixes, removed trailing dots, and then validated the value as either a literal IP address or a strict hostname before any command was built. If the value did not match those rules, the view now returns Invalid domain instead of executing a command. The command invocation was changed from a formatted string to an argument list, ['nslookup', domain] or ['dig', domain], and shell=True was removed so the OS shell can no longer interpret user-controlled data.

Guidance Adherence

Source: Pixee Knowledge Base

Applied the following guidance from the remediation instructions:

• Prevent command injection vulnerabilities by sanitizing inputs and/or validating user input: the patch strips and normalizes the domain, removes schemes/www, rejects invalid values with ipaddress.ip_address(...) plus a hostname regex, and returns "Invalid domain" for bad input, which directly implements the guidance to prevent malicious command content.
• Avoid constructing the OS command from user-controlled data: the patch replaces string interpolation ("nslookup {}".format(domain) / "dig {}".format(domain)) with argument lists (['nslookup', domain] / ['dig', domain]) and removes shell=True, which aligns with the secure command-execution approach implied by the guidance and eliminates shell injection risk.
• Use only standard-library support for validation: the added ipaddress import is from Python’s stdlib, so no external dependency was introduced and no manifest update was required.

The fix is therefore aligned with the security guidance and follows the expected secure coding pattern for command execution. It also remains stylistically consistent with the surrounding Python/Django code (same function structure and response rendering pattern).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud