At the very least, sanitize user input! If I would provide a parameter value dataroot="foo; rm -rf ; echo --", it would expand to python pix2pixHD/test.py --dataroot foo; rm -rf / ;echo -- --checkpoints_dir [...] which is bad.
15: that test.py file is short. Why not make that a function and call it in the same tool instead of creating a child process. Don't assume the python in the $PATH is the same python that executes this script.
58: This is probably a no-op since every os.system call likely opens a new shell. You can set the environment of the currently running interpreter with os.setenv IIRC
72: Use os.path.makedirs. Or better use tempfile.mkdtemp or similar.
At the very least, sanitize user input! If I would provide a parameter value
dataroot="foo; rm -rf ; echo --"
, it would expand topython pix2pixHD/test.py --dataroot foo; rm -rf / ;echo -- --checkpoints_dir [...]
which is bad.test.py
file is short. Why not make that a function and call it in the same tool instead of creating a child process. Don't assume thepython
in the $PATH is the same python that executes this script.os.setenv
IIRCos.path.makedirs
. Or better usetempfile.mkdtemp
or similar.os.path.copyfile