Fix command injection vulnerability in grep_processes endpoint

[semgrep-code-studentsca023-rgb]

Fix command injection vulnerability in grep_processes by removing shell=True and processing output safely in Python.

Changes

• Replaced shell=True subprocess call with safe argument list ["ps", "aux"]
• Moved grep filtering and awk field extraction to Python code
• User input is no longer interpolated into shell commands

Why

The original code concatenated user input directly into a shell command string with shell=True, allowing attackers to inject arbitrary commands (e.g., ; rm -rf /). The fix eliminates shell interpretation entirely by passing arguments as a list and filtering results in Python, following the secure-by-default approach recommended by Semgrep.

Semgrep Finding Details

Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system.
To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.
Untrusted input in a command can lead to command injection,
allowing attackers to execute arbitrary commands and gain
control of the system. To prevent this:

1. Avoid direct command execution: Don't run OS commands
   with user input directly.
2. Validate and sanitize input: Ensure input is safe by
   removing or escaping dangerous characters.
3. (preferred) Use safe methods: Use subprocess.run
   without shell=True to safely execute commands, as it
   doesn't call a system shell by default. If shell=True
   is necessary, properly quote and escape all input to prevent
   shell injection. This is a secure by default approach.

@267212124 requested Semgrep Assistant generate this pull request to fix a finding from the detection rule python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default.

---

⚠️ Review carefully before merging. This PR was generated by AI and may cause breaking changes or introduce new vulnerabilities.