Fix sec issues

grycap · Oct 11, 2022 · 789b9b1 · 789b9b1
1 parent ce2d45e
commit 789b9b1
Show file tree

Hide file tree

Showing 6 changed files with 16 additions and 3 deletions.
diff --git a/IM/connectors/OpenNebula.py b/IM/connectors/OpenNebula.py
@@ -14,8 +14,8 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import defusedxml.xmlrpc
-defusedxml.xmlrpc.monkey_patch()
+from defusedxml import xmlrpc
+xmlrpc.monkey_patch()
 
 try:
     from xmlrpclib import ServerProxy  # nosec

diff --git a/im_service.py b/im_service.py
@@ -382,7 +382,8 @@ def im_stop():
 def get_childs(parent_id=None):
     if parent_id is None:
         parent_id = os.getpid()
-    ps_command = subprocess.Popen("ps -o pid --ppid %d --noheaders" % parent_id, shell=True, stdout=subprocess.PIPE)
+    ps_command = subprocess.Popen(["ps", "-o", "pid", "--ppid", str(parent_id), "--noheaders"],
+                                    stdout=subprocess.PIPE)
     ps_command.wait()
     ps_output = str(ps_command.stdout.read())
     childs = ps_output.strip().split("\n")[:-1]

diff --git a/test/integration/QuickTestIM.py b/test/integration/QuickTestIM.py
@@ -25,6 +25,9 @@
 import sys
 import os
 
+from defusedxml import xmlrpc
+xmlrpc.monkey_patch()
+
 sys.path.append("..")
 sys.path.append(".")
 

diff --git a/test/integration/TestIM.py b/test/integration/TestIM.py
@@ -26,6 +26,9 @@
 import sys
 import os
 
+from defusedxml import xmlrpc
+xmlrpc.monkey_patch()
+
 sys.path.append("..")
 sys.path.append(".")
 

diff --git a/test/loadtest/LoadTest.py b/test/loadtest/LoadTest.py
@@ -28,6 +28,9 @@
 except ImportError:
     from xmlrpc.client import ServerProxy
 
+from defusedxml import xmlrpc
+xmlrpc.monkey_patch()
+
 sys.path.append("..")
 sys.path.append(".")
 

diff --git a/test/loadtest/LoadTestR.py b/test/loadtest/LoadTestR.py
@@ -28,6 +28,9 @@
 except ImportError:
     from xmlrpc.client import ServerProxy
 
+from defusedxml import xmlrpc
+xmlrpc.monkey_patch()
+
 sys.path.append("..")
 sys.path.append(".")