search

shinebayar-g / ufw-docker-automated

Manage docker containers firewall with UFW!
Apache License 2.0
198 stars 31 forks source link

Run ufw commands with no shell to improve speed #13

Closed mlollo closed 3 years ago

mlollo commented 3 years ago

I was wondering if I could improve speed using shell=False in subprocess.run and I stumbled in this thread : piping in shell via Python subprocess module. And now I understand why all the parsing is important. Because someone could try to inject commands in those docker labels and try to run something with higher privilege. If somehow those input validation are broken in the future, could it be a good idea to use subprocess.run with shell=False ? Because without shell piping is not working. This could prevent a scenario like this and probably improve speed.

mlollo commented 3 years ago

Implemented in ufw-update-onrestart