Prevent Command Injection in introduction/views.py

[pixee-integration-test]

Pixee Scan: d6a5c69e-0dfc-4921-8f83-fb77f37df46d

Confidence: HIGH

Fix confidence is a rating derived from an internal benchmark and includes High, Medium, and Low confidence fixes. It comprises three weighted scores reflecting the safety, effectiveness and cleanliness of Pixee's code changes within a fix. View Details in Pixee.

---

Remediation

This change fixes finding AZVdjxO-h0BHfERFoIIK.

Details

Prevent Command Injection in introduction/views.py

Summary

Prevented command injection in introduction/views.py by removing shell-based command construction from the domain lookup path.

Vulnerability Description

Command Injection occurs when an application builds an operating system command from untrusted input and executes it through a shell. This is dangerous because shell metacharacters and argument separators can let an attacker run arbitrary commands with the application's privileges. A successful exploit can expose data, modify files, or fully compromise the host process.

Changes Made

The vulnerable code in introduction/views.py concatenated the user-controlled domain value into nslookup or dig command strings and executed them with subprocess.Popen(..., shell=True). That pattern allowed the POSTed domain field to be interpreted as part of a shell command instead of as data. The fix added validation to reject empty or malformed domains, normalized the input with trimming, and required the value to match a strict hostname/IP regular expression before execution. It also switched to passing ['nslookup', domain] or ['dig', domain] as an argument list and set shell=False, which keeps the lookup utility behavior while separating code from user data.

Guidance Adherence

Source: Pixee Knowledge Base

Applied the following guidance from the remediation guidance and Sonar issue description for pythonsecurity:S2076:

• Prevent command injection by sanitizing inputs and/or validating user input: the fix now strips the domain, rejects empty values, and validates the domain with a strict regex before using it, which directly follows the guidance to ensure user-controlled data does not contain malicious commands.
• Do not construct the OS command from user-controlled data: the command is now built as an argument list (['nslookup', domain] / ['dig', domain]) instead of a formatted string, and subprocess.Popen is invoked with shell=False, which aligns with the recommended safe approach for command execution and removes the shell-injection vector.

No specific preferred library/framework, style convention, or dependency addition was required by the guidance, so those criteria are satisfied by default. The remediation approach matches the security guidance, and no new manifest dependency is needed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud