I am new at using and programming web applications, so I wanted to ask a question. Is it safe to execute os commands like copy and mv and delete from a web app that is running on an apache, or does it bring up security issues?More specific I am using django, and I want a view of mine when it is executed to be able to run os commands like copy move etc to folders that reside outside the var/www folder. I know how to use os module but I haven't found from my web search if it is safe to do it.
If user input has no influence on the commands or their arguments, there should be no immediate threat.
But it is always a risk, you might be missing something or there might be (i.e., there are for sure) unknown vulnerabilities in the software you're using (e.g., Django).
What I would do to mitigate those cases would be to:
When you build commands which include user-supplied strings, there is always a risk of command injection.
Example code which is supposed to copy a file to a name provided by the user:
When the filename is supplied by the user, they could pass this:
resulting in the OS receiving
which are actually two commands, the second one being malicious (remove all png-files from the directory).
Yes, it can! This is extremely insecure and considered one of the top poor practices in the security industry. There are many things that can go wrong:
Now, I don't know what you're trying to do but if you insist on proceeding, keep the following in mind: