95bb7f3b78
Signed-off-by: maipbui <maibui@microsoft.com> #### Why I did it The [xml.etree.ElementTree](https://docs.python.org/3/library/xml.etree.elementtree.html#module-xml.etree.ElementTree) module is not secure against maliciously constructed data. `os` - not secure against maliciously constructed input and dangerous if used to evaluate dynamic content `subprocess.getstatusoutput` is dangerous because include shell=True in the implementation #### How I did it Remove xml. Use [lxml](https://pypi.org/project/lxml/) XML parsers package that prevent potentially malicious operation. Replace `os` by `subprocess` Use command as an array instead of string Use `getstatusoutput_noshell` in `sonic_py_common` lib |
||
|---|---|---|
| .. | ||
| pddf | ||
| RA-B6510-48V8C | ||
| sonic_platform_config | ||
| custom_led.bin | ||
| default_sku | ||
| dev.xml | ||
| installer.conf | ||
| led_proc_init.soc | ||
| monitor.py | ||
| pcie.yaml | ||
| pddf_support | ||
| platform_asic | ||
| platform_env.conf | ||
| pmon_daemon_control.json | ||
| sensors.conf | ||
| systest.py | ||