[Security] Harden installer shell hook execution and command trust boundary #237

New Issue

zemion · 2026-07-11T12:51:01+02:00

zemion commented

2026-07-11 12:51:01 +02:00

Bandit and Semgrep both flag shell execution in the module installer. This is the highest-severity finding in the full GovOPlaN audit.

Classification: structural security work.

Report evidence:

govoplan-core/src/govoplan_core/core/module_installer.py:2614 restart command uses subprocess.run(..., shell=True).
govoplan-core/src/govoplan_core/core/module_installer.py:3224 database backup/restore hook uses subprocess.run(..., shell=True).
Bandit: B602 high; Semgrep: subprocess-shell-true.

Suggested next steps:

Define a structured argv contract for restart/database hooks or a tightly validated command allowlist.
Preserve operator flexibility without passing arbitrary strings to a shell.
Keep secret redaction already implemented for records/stdout/stderr.

Baseline report directory: audit-reports/govoplan-full-20260711-1238

Bandit and Semgrep both flag shell execution in the module installer. This is the highest-severity finding in the full GovOPlaN audit. Classification: **structural security work**. Report evidence: - `govoplan-core/src/govoplan_core/core/module_installer.py:2614` restart command uses `subprocess.run(..., shell=True)`. - `govoplan-core/src/govoplan_core/core/module_installer.py:3224` database backup/restore hook uses `subprocess.run(..., shell=True)`. - Bandit: `B602` high; Semgrep: `subprocess-shell-true`. Suggested next steps: - Define a structured argv contract for restart/database hooks or a tightly validated command allowlist. - Preserve operator flexibility without passing arbitrary strings to a shell. - Keep secret redaction already implemented for records/stdout/stderr. Baseline report directory: `audit-reports/govoplan-full-20260711-1238`

zemion added the

labels 2026-07-11 12:51:01 +02:00

zemion commented

2026-07-11 12:51:47 +02:00