michalslowikowski00 commented on a change in pull request #12638:
URL: https://github.com/apache/airflow/pull/12638#discussion_r530845944
##########
File path: airflow/operators/bash.py
##########
@@ -157,14 +163,31 @@ def pre_exec():
self.log.info('Running command: %s', self.bash_command)
- self.sub_process = Popen( # pylint:
disable=subprocess-popen-preexec-fn
- ['bash', "-c", self.bash_command],
- stdout=PIPE,
- stderr=STDOUT,
- cwd=tmp_dir,
- env=env,
- preexec_fn=pre_exec,
- )
+ if isinstance(self.bash_command) == str and not
_is_bash_script(self.bash_command):
+ warnings.warn(
+ "Warning: Using a string in the BashOperator leaves your
system open to bash injection "
+ "attacks via escape strings. Please use a list[str]
instead.\n"
+ "\n"
+ "We also highly recommend against using [\"bash\",
\"-c\"... in your command as"
+ "that command will essentially negate any security that
Popen can offer you."
+ )
+ self.sub_process = Popen( # pylint:
disable=subprocess-popen-preexec-fn
+ ['bash', "-c", self.bash_command],
+ stdout=PIPE,
+ stderr=STDOUT,
+ cwd=tmp_dir,
+ env=env,
+ preexec_fn=pre_exec,
+ )
+ elif isinstance(self.bash_command) == list:
Review comment:
```suggestion
elif isinstance(self.bash_command, list):
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
