From 48beee551b7cd331e4ff72898ab66b9185f90bf7 Mon Sep 17 00:00:00 2001
From: Semgrep Autofix <autofix@semgrep.com>
Date: Tue, 17 Mar 2026 07:38:45 +0000
Subject: [PATCH] Fix command injection vulnerability in grep_processes
 endpoint

Fix command injection vulnerability in the `/grep_processes` endpoint by removing `shell=True` and handling filtering in Python.

## Changes
- Removed `shell=True` from `subprocess.run()` call
- Changed command from shell string to safe argument list `["ps", "aux"]`
- Replaced shell-based `grep` and `awk` pipeline with Python string filtering
- Added input validation to check if `name` parameter is provided

## Why
The original code concatenated untrusted user input (`name` parameter) directly into a shell command with `shell=True`. This allowed attackers to inject arbitrary shell commands (e.g., `; rm -rf /` or `$(malicious_command)`).

By removing `shell=True` and passing arguments as a list, the subprocess module no longer invokes a shell interpreter, eliminating the command injection vector. The filtering logic is now performed safely in Python.

## Semgrep Finding Details
Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system.
To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.
Untrusted input in a command can lead to command injection,
allowing attackers to execute arbitrary commands and gain
control of the system. To prevent this:

1. Avoid direct command execution: Don't run OS commands
with user input directly.
2. Validate and sanitize input: Ensure input is safe by
removing or escaping dangerous characters.
3. (preferred) Use safe methods: Use `subprocess.run`
without `shell=True` to safely execute commands, as it
doesn't call a system shell by default. If `shell=True`
is necessary, properly quote and escape all input to prevent
shell injection. This is a secure by default approach.


@267212124 requested Semgrep Assistant generate this pull request to fix [a finding](https://semgrep.dev/orgs/studentsca023_personal_org/findings/722169010) from the detection rule [python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default](https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-default.tainted-os-command-stdlib-flask-secure-default).
---
 flask_webgoat/actions.py | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/flask_webgoat/actions.py b/flask_webgoat/actions.py
index f75e57eb..73a8b543 100644
--- a/flask_webgoat/actions.py
+++ b/flask_webgoat/actions.py
@@ -40,16 +40,28 @@ def log_entry():
 @bp.route("/grep_processes")
 def grep_processes():
     name = request.args.get("name")
-    # vulnerability: Remote Code Execution
+    if name is None:
+        return jsonify({"error": "name parameter is required"})
+
+    # Run ps aux without shell=True to prevent command injection
     res = subprocess.run(
-        ["ps aux | grep " + name + " | awk '{print $11}'"],
-        shell=True,
+        ["ps", "aux"],
         capture_output=True,
     )
     if res.stdout is None:
         return jsonify({"error": "no stdout returned"})
+
     out = res.stdout.decode("utf-8")
-    names = out.split("\n")
+    lines = out.split("\n")
+
+    # Filter lines containing the name and extract the 11th column (command)
+    names = []
+    for line in lines:
+        if name in line:
+            parts = line.split()
+            if len(parts) >= 11:
+                names.append(parts[10])  # 0-indexed, so 11th column is index 10
+
     return jsonify({"success": True, "names": names})