You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by GitBox <gi...@apache.org> on 2020/11/26 08:23:00 UTC
[GitHub] [airflow] michalslowikowski00 commented on a change in pull request #12638: Allow BashOperator to take command as list
michalslowikowski00 commented on a change in pull request #12638:
URL: https://github.com/apache/airflow/pull/12638#discussion_r530845944
##########
File path: airflow/operators/bash.py
##########
@@ -157,14 +163,31 @@ def pre_exec():
self.log.info('Running command: %s', self.bash_command)
- self.sub_process = Popen( # pylint: disable=subprocess-popen-preexec-fn
- ['bash', "-c", self.bash_command],
- stdout=PIPE,
- stderr=STDOUT,
- cwd=tmp_dir,
- env=env,
- preexec_fn=pre_exec,
- )
+ if isinstance(self.bash_command) == str and not _is_bash_script(self.bash_command):
+ warnings.warn(
+ "Warning: Using a string in the BashOperator leaves your system open to bash injection "
+ "attacks via escape strings. Please use a list[str] instead.\n"
+ "\n"
+ "We also highly recommend against using [\"bash\", \"-c\"... in your command as"
+ "that command will essentially negate any security that Popen can offer you."
+ )
+ self.sub_process = Popen( # pylint: disable=subprocess-popen-preexec-fn
+ ['bash', "-c", self.bash_command],
+ stdout=PIPE,
+ stderr=STDOUT,
+ cwd=tmp_dir,
+ env=env,
+ preexec_fn=pre_exec,
+ )
+ elif isinstance(self.bash_command) == list:
Review comment:
```suggestion
elif isinstance(self.bash_command, list):
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org