Skip to content

Commit

Permalink
util.py: improve sanitize_opts_arg to be reused by other plug-ins
Browse files Browse the repository at this point in the history
  • Loading branch information
rhyw committed Mar 21, 2024
1 parent b3503d4 commit 5f5e435
Showing 1 changed file with 15 additions and 1 deletion.
16 changes: 15 additions & 1 deletion py/common/util.py
Original file line number Diff line number Diff line change
Expand Up @@ -42,15 +42,29 @@ def arg_value_by_name(parser, args, arg_name):
return getattr(args, action.dest)


def convert_option_to_dest(parser, arg_name):
"""
Convert a command line option to its destination variable name
"""
for action in parser._actions:
if arg_name in action.option_strings:
return action.dest
return None


def sanitize_opts_arg(parser, args, arg_name):
"""sanitize command-line options passed to an option of argparse.ArgumentParser"""
opts_str = arg_value_by_name(parser, args, arg_name)
if opts_str is None:
return None

dest = convert_option_to_dest(parser, arg_name)
if dest is None:
return None

# split, quote, and rejoin the options to avoid shell injection
try:
split_opts = shlex.split(args.snyk_code_test_opts)
split_opts = shlex.split(getattr(args, dest))

# starting with Python 3.8, one can use shlex.join(split_opts)
return ' '.join(shlex.quote(arg) for arg in split_opts)
Expand Down

0 comments on commit 5f5e435

Please sign in to comment.