In main.py:303-326, the /contribute endpoint reads fields from the request JSON body and passes them directly to check_output():
PR_TITLE = data.get('title')
PR_BODY = data.get('desc')
AUTHOR_NAME = data.get('auth')
STUDY_NAME = data.get('study')
STUDY_NAME_PATH = data.get('path')
BRANCH_NAME = data.get('branch')
proc = check_output(["contribute", STUDY_NAME, STUDY_NAME_PATH, AUTHOR_NAME, BRANCH_NAME, PR_TITLE, PR_BODY],
cwd=concore_path, shell=True)
On Windows shell=True is used, meaning these user-supplied strings are passed through the shell interpreter. A malicious payload like "; rm -rf / #" in any field could execute arbitrary commands. Either remove shell=True or sanitize all inputs with shlex.quote().
In main.py:303-326, the /contribute endpoint reads fields from the request JSON body and passes them directly to check_output():
On Windows shell=True is used, meaning these user-supplied strings are passed through the shell interpreter. A malicious payload like "; rm -rf / #" in any field could execute arbitrary commands. Either remove shell=True or sanitize all inputs with shlex.quote().