Credo.Check.Warning.UnsafeExec (Credo v1.5.0-rc.5) View Source

This check has a base priority of high and works with any version of Elixir.

Explanation

Spawning external commands can lead to command injection vulnerabilities.

Use a safe API where arguments are passed as an explicit list, rather than unsafe APIs that run a shell to parse the arguments from a single string.

Safe APIs include:

  • System.cmd/2,3
  • :erlang.open_port/2, passing {:spawn_executable, file_name} as the first parameter, and any arguments using the :args option

Unsafe APIs include:

Configuration parameters

There are no parameters for this check.

Link to this section Summary

Link to this section Functions

Link to this function

do_run_on_source_file(exec, source_file, params)

View Source