fix: prevent OS Command Injection

2026-06-29 16:19:33 +02:00
parent b1a792502f
commit f302357545
1 changed files with 4 additions and 2 deletions
@@ -418,11 +418,13 @@ def schedule(


 def os_open(file: str) -> None:
+    import subprocess
+
    if os.uname().sysname == "Linux":
-        os.system(f"xdg-open {file}")
+        subprocess.run(["xdg-open", file])
    else:
        print(f"Opening file {file}", file=sys.stderr)
-        os.system(f"open {file}")
+        subprocess.run(["open", file])


 def extract_players(pdf_file: Path) -> List[str]: