From 306da440a2970111657a4bc73ffef9ab897c09d5 Mon Sep 17 00:00:00 2001 From: Test User Date: Thu, 13 Nov 2025 17:13:57 -0800 Subject: [PATCH] Fix shell injection vulnerability in environment variable handling Replace os.system() call with direct file writing and use shlex.quote() to properly escape CLEARML_AUTH_TOKEN value, preventing potential shell injection attacks. --- clearml_session/interactive_session_task.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/clearml_session/interactive_session_task.py b/clearml_session/interactive_session_task.py index 96e1049..611f38e 100644 --- a/clearml_session/interactive_session_task.py +++ b/clearml_session/interactive_session_task.py @@ -1,6 +1,7 @@ import base64 import json import os +import shlex import shutil import socket import subprocess @@ -1028,8 +1029,9 @@ def setup_user_env(param, task): elif os.environ.get("CLEARML_AUTH_TOKEN"): env['CLEARML_AUTH_TOKEN'] = os.environ.get("CLEARML_AUTH_TOKEN") - os.system("echo 'export CLEARML_AUTH_TOKEN=\"{}\"' >> {}".format( - os.environ.get("CLEARML_AUTH_TOKEN").replace('$', '\\$'), source_conf)) + with open(os.path.expanduser(source_conf), 'a') as f: + f.write('export CLEARML_AUTH_TOKEN={}\n'.format( + shlex.quote(os.environ.get("CLEARML_AUTH_TOKEN")))) if param.get("default_docker"): os.system("echo 'export CLEARML_DOCKER_IMAGE=\"{}\"' >> {}".format(