Fixed a bug where Smoothie wasn't converting input videos into their absolute paths.
Instead of using "shell = True" to pipe input into ffmpeg from vspipe, pipe using python itself.
Why did you remove shell = True?
You can invoke a process in 2 ways in Python either using the system shell (shell = True) or via Python itself.
Using shell = True can open access to the system shell entirely and if a user somehow access to the run/Popen with shell = True, they can execute shell commands which can compromise security of the program itself.
In the case of Smoothie, this access to the system shell is via this config value:
Why did you remove
shell = True
?You can invoke a process in 2 ways in Python either using the system shell (
shell = True
) or via Python itself. Usingshell = True
can open access to the system shell entirely and if a user somehow access to therun/Popen
withshell = True
, they can execute shell commands which can compromise security of the program itself. In the case of Smoothie, this access to the system shell is via this config value:Say we set up the value like this:
With
shell = True
: https://user-images.githubusercontent.com/41850963/158943894-3b4782d2-13b2-4ff4-babf-4dee4d494ff9.mp4Using Python to pipe: https://user-images.githubusercontent.com/41850963/158944319-0ecf65f6-937c-472f-8fef-32c65d08e0f8.mp4