Removed all shell=True from command executions.

modoboa/admin/api/v2/serializers.py

@@ -274,7 +274,7 @@ class AdminGlobalParametersSerializer(serializers.Serializer):
     def validate_dkim_keys_storage_dir(self, value):
         """Check that directory exists."""
         if value:
-            code, output = exec_cmd("which openssl", shell=True)
+            code, output = exec_cmd(["which", "openssl"])
             if code:
                 raise serializers.ValidationError(
                     _("openssl not found, please make sure it is installed.")

modoboa/admin/app_settings.py

@@ -298,7 +298,7 @@ def init_structure() -> dict:
     structure = copy.deepcopy(GLOBAL_PARAMETERS_STRUCT)
     hide_fields = False
     dpath = None
-    code, output = exec_cmd("which dovecot", shell=True)
+    code, output = exec_cmd(["which", "dovecot"])
     if not code:
         dpath = force_str(output).strip()
     else:
@@ -312,7 +312,7 @@ def init_structure() -> dict:
                 dpath = fpath
     if dpath:
         try:
-            code, version = exec_cmd(f"{dpath} --version", shell=True)
+            code, version = exec_cmd([dpath, "--version"])
         except OSError:
             hide_fields = True
         else:

modoboa/amavis/lib.py

@@ -113,7 +113,7 @@ class SpamassassinClient:
 
     def _find_binary(self, name: str) -> str:
         """Find path to binary."""
-        code, output = exec_cmd(f"which {name}", shell=True)
+        code, output = exec_cmd(["which", name])
         if not code:
             return smart_str(output).strip()
         known_paths = getattr(settings, "SA_LOOKUP_PATH", ("/usr/bin",))

modoboa/lib/sysutils.py

@@ -33,7 +33,11 @@ def exec_cmd(
     :return: return code, command output
     """
     if sudo_user is not None:
-        cmd = f"sudo -u {sudo_user} {cmd}"
+        if isinstance(cmd, list):
+            cmd = ["sudo", "-u", sudo_user] + cmd
+        else:
+            cmd = f"sudo -u {sudo_user} {cmd}"
+
     if pinput is not None:
         kwargs["stdin"] = subprocess.PIPE
     if capture_output:
@@ -62,7 +66,7 @@ def doveadm_cmd(params: list[str], pinput=None, capture_output=True, **kwargs):
     :return: return code, command output
     """
     dpath = None
-    code, output = exec_cmd("which doveadm", shell=True)
+    code, output = exec_cmd(["which", "doveadm"])
     if not code:
         dpath = force_str(output).strip()
     else:

modoboa/maillog/graphics.py

@@ -75,7 +75,7 @@ class Graphic:
     def rrdtool_binary(self):
         """Return path to rrdtool binary."""
         dpath = None
-        code, output = exec_cmd("which rrdtool", shell=True)
+        code, output = exec_cmd(["which", "rrdtool"])
         if not code:
             dpath = output.strip()
         else: