From ad6977f940d3e64d78a4367452d9a338ad43fa1c Mon Sep 17 00:00:00 2001 From: Uwe Date: Mon, 3 Jan 2022 23:47:04 +0100 Subject: [PATCH] 0004809: Security vulnerability in DWG import when using ODA file converter manual backport of commit 1742d7ff --- src/Mod/Draft/importDWG.py | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/src/Mod/Draft/importDWG.py b/src/Mod/Draft/importDWG.py index 2820d02fca..ac418d758d 100644 --- a/src/Mod/Draft/importDWG.py +++ b/src/Mod/Draft/importDWG.py @@ -44,8 +44,6 @@ https://knowledge.autodesk.com/support/autocad/downloads/ # * * # *************************************************************************** -# TODO: use subprocess.popen() instead of subprocess.call() - import six import FreeCAD from FreeCAD import Console as FCC @@ -217,10 +215,10 @@ def convertToDxf(dwgfilename): indir = os.path.dirname(dwgfilename) outdir = tempfile.mkdtemp() basename = os.path.basename(dwgfilename) - cmdline = ('"%s" "%s" "%s" "ACAD2000" "DXF" "0" "1" "%s"' - % (teigha, indir, outdir, basename)) - FCC.PrintMessage(translate("ImportDWG", "Converting: ") - + cmdline + "\n") + cmdline = [teigha, indir, outdir, "ACAD2000", "DXF", "0", "1", basename] + FCC.PrintMessage(translate("draft", "Converting:") + " " + str(cmdline) + "\n") + proc = subprocess.Popen(cmdline) + proc.communicate() if six.PY2: if isinstance(cmdline, six.text_type): encoding = sys.getfilesystemencoding() @@ -270,10 +268,9 @@ def convertToDwg(dxffilename, dwgfilename): indir = os.path.dirname(dxffilename) outdir = os.path.dirname(dwgfilename) basename = os.path.basename(dxffilename) - cmdline = ('"%s" "%s" "%s" "ACAD2000" "DWG" "0" "1" "%s"' - % (teigha, indir, outdir, basename)) - FCC.PrintMessage(translate("ImportDWG", "Converting: ") - + cmdline + "\n") - subprocess.call(cmdline, shell=True) # os.system(cmdline) + cmdline = [teigha, indir, outdir, "ACAD2000", "DWG", "0", "1", basename] + FCC.PrintMessage(translate("draft", "Converting:") + " " + str(cmdline) + "\n") + proc = subprocess.Popen(cmdline) + proc.communicate() return dwgfilename return None