Prevent Command Injection in cmd_lab

[pixee-integration-test]

Pixee Scan: 42d5e1fa-8134-47c0-8a1e-da7f97c83698

Confidence: HIGH

Fix confidence is a rating derived from an internal benchmark and includes High, Medium, and Low confidence fixes. It comprises three weighted scores reflecting the safety, effectiveness and cleanliness of Pixee's code changes within a fix. View Details in Pixee.

---

Remediation

This change fixes finding AZVdjxO-h0BHfERFoIIK.

Details

Prevent Command Injection in cmd_lab

Summary

Prevent Command Injection in the cmd_lab view in introduction/views.py.

Vulnerability Description

Command Injection happens when an application passes attacker-controlled data into an operating system command without strict validation. If the shell interprets that data, an attacker can append extra commands or metacharacters and execute arbitrary code with the application's privileges. That can lead to data theft, system tampering, or full host compromise.

Changes Made

The cmd_lab view in introduction/views.py previously inserted request.POST.get('domain') directly into nslookup or dig and executed it with subprocess.Popen(..., shell=True), which allowed the shell to interpret user input. The fix added input checks that reject missing values and normalize the supplied domain by trimming whitespace, removing an optional scheme and www, and stripping any path, query, fragment, or trailing dot. It then validates the remaining value against a strict domain-name regular expression before continuing. The command is now built as an argument list, `[

Guidance Adherence

Source: Pixee Knowledge Base

Applied the following guidance from Sonar remediation guidance for pythonsecurity:S2076:

• Prevent command injection by sanitizing inputs and/or validating user input: the patch now normalizes domain, strips URL prefixes/path fragments, and enforces a strict whitelist regex for valid domain names before any command is built. This follows the guidance to ensure user-controlled data does not contain malicious commands.
• Do not construct the OS command from user-controlled data: the code changed from string interpolation ("nslookup {}".format(domain) / "dig {}".format(domain)) to argv-style lists (["nslookup", domain] / ["dig", domain]) and removed shell=True, which aligns with the remediation goal of avoiding shell-based command construction and command injection.
• No extra dependency requirement in guidance: the fix uses existing modules (re, subprocess) already available in the file, so no manifest update was needed.

Overall, the patch matches the security guidance and uses the standard safe subprocess pattern with input validation.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud