MediumPython

Fix Command Injection

PythonSecurity

The function below builds a shell command string by concatenating a filename into it — the kind of string a naive subprocess.run(cmd, shell=True) call would execute.

The bug: an attacker can pass "report.txt; rm -rf /" as the filename. When run with shell=True, the shell treats ; as a command separator and executes both commands.

Your task: fix solve(filename) so it returns an argument list['cat', filename] — instead of a shell string. Passed to subprocess.run(argv, shell=False), the filename is treated as a single literal argument no matter what characters it contains; there's no shell to interpret ;, $(), or &&.

solve('report.txt')        # → ['cat', 'report.txt']
solve('file; rm -rf /')    # → ['cat', 'file; rm -rf /']   (one argument, not two commands)

Sample tests

Test #1Normal filename
Input: ["report.txt"]
Output: ["cat","report.txt"]
Test #2Another normal filename
Input: ["data.csv"]
Output: ["cat","data.csv"]
Test #3Semicolon injection stays inert, single argument
Input: ["file; rm -rf /"]
Output: ["cat","file; rm -rf /"]