Prevent Command Injection in introduction/views.py

[pixee-integration-test]

Pixee Scan: 115f7fab-c7b6-48c8-9833-129de3641014

Confidence: HIGH

Fix confidence is a rating derived from an internal benchmark and includes High, Medium, and Low confidence fixes. It comprises three weighted scores reflecting the safety, effectiveness and cleanliness of Pixee's code changes within a fix. View Details in Pixee.

---

Remediation

This change fixes finding AZVdjxO-h0BHfERFoIIK.

Details

Prevent Command Injection in introduction/views.py

Summary

Prevent command injection in introduction/views.py.

Vulnerability Description

Command Injection occurs when an application builds an operating system command from untrusted input and passes it to a shell or command interpreter. An attacker can abuse this pattern to run arbitrary commands with the privileges of the application, which can lead to data exposure, system compromise, or lateral movement. The risk is especially high when user input is inserted directly into a command string without strict validation.

Changes Made

The vulnerable code in introduction/views.py built nslookup and dig commands by formatting the user-controlled domain value into a shell command and executing it with subprocess.Popen(..., shell=True). That pattern allowed attacker-supplied metacharacters in domain to be interpreted by the OS shell. The fix added server-side validation for domain using ipaddress.ip_address and a hostname allowlist regex, rejecting invalid values with an "Invalid domain" response before any subprocess call.

The command execution path was also changed to pass an argument list, `[\

Guidance Adherence

Source: Pixee Knowledge Base

Applied the following guidance from the remediation guidance section for pythonsecurity:S2076:

• Prevent command injection vulnerabilities by sanitizing inputs and/or validating user input: The patch adds explicit validation of domain before execution, using ipaddress.ip_address(domain) and a regex fullmatch(...) fallback, and rejects invalid input with Invalid domain. This matches the guidance’s requirement to validate/sanitize user-controlled data so it cannot carry malicious command content.
• Change this code to not construct the OS command from user-controlled data: The patch stops building a shell command string with "nslookup {}".format(domain) / "dig {}".format(domain) and instead passes argument lists ['nslookup', domain] / ['dig', domain] to subprocess.run(..., shell=False, capture_output=True, text=True). This is the correct command-injection mitigation because it avoids shell interpretation entirely.
• No new dependency requirement in the guidance: The fix uses only Python standard library modules (ipaddress, re) already available in the runtime, so there was no manifest update needed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud