kontron / python-ipmi / 37275639052

94%

push

github

interfaces: ipmitool: quote credentials passed to the shell

The ipmitool command line is executed with shell=True and the username
and password were only enclosed in double quotes. Characters like '$',
'`', '"' or '\' are still interpreted by the shell inside double quotes.
Passwords like 'pa$$word' or 'pa$_ss' were mangled and a password
containing backticks led to command execution on the host.

Quote the credentials with shlex.quote() where the command is built
instead of escaping them in the Session object, which is shared with
the native interfaces.

Supersedes #185.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>

5 of 5 new or added lines in 1 file covered. (100.0%)

5746 of 7454 relevant lines covered (77.09%)

4.63 hits per line