Fix command injection vulnerability in grep_processes endpoint

[semgrep-code-studentsca023-rgb]

Fix command injection vulnerability in the /grep_processes endpoint by removing shell=True and handling filtering in Python.

Changes

• Removed shell=True from subprocess.run() call
• Changed command from shell string to safe argument list ["ps", "aux"]
• Replaced shell-based grep and awk pipeline with Python string filtering
• Added input validation to check if name parameter is provided

Why

The original code concatenated untrusted user input (name parameter) directly into a shell command with shell=True. This allowed attackers to inject arbitrary shell commands (e.g., ; rm -rf / or $(malicious_command)).

By removing shell=True and passing arguments as a list, the subprocess module no longer invokes a shell interpreter, eliminating the command injection vector. The filtering logic is now performed safely in Python.

Semgrep Finding Details

Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system.
To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.
Untrusted input in a command can lead to command injection,
allowing attackers to execute arbitrary commands and gain
control of the system. To prevent this:

1. Avoid direct command execution: Don't run OS commands
   with user input directly.
2. Validate and sanitize input: Ensure input is safe by
   removing or escaping dangerous characters.
3. (preferred) Use safe methods: Use subprocess.run
   without shell=True to safely execute commands, as it
   doesn't call a system shell by default. If shell=True
   is necessary, properly quote and escape all input to prevent
   shell injection. This is a secure by default approach.

@267212124 requested Semgrep Assistant generate this pull request to fix a finding from the detection rule python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default.

---

⚠️ Review carefully before merging. This PR was generated by AI and may cause breaking changes or introduce new vulnerabilities.