From 1863f5586b27cc3aecf3d0c4ed9a97bae1320260 Mon Sep 17 00:00:00 2001
From: Rene Luria <rene.luria@infomaniak.com>
Date: Mon, 29 Jun 2026 16:19:33 +0200
Subject: [PATCH] fix: prevent OS Command Injection

---
 myice/myice.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/myice/myice.py b/myice/myice.py
index 6aaaf3f..7529578 100755
--- a/myice/myice.py
+++ b/myice/myice.py
@@ -418,11 +418,13 @@ def schedule(
 
 
 def os_open(file: str) -> None:
+    import subprocess
+
     if os.uname().sysname == "Linux":
-        os.system(f"xdg-open {file}")
+        subprocess.run(["xdg-open", file])
     else:
         print(f"Opening file {file}", file=sys.stderr)
-        os.system(f"open {file}")
+        subprocess.run(["open", file])
 
 
 def extract_players(pdf_file: Path) -> List[str]: