Code RoomShell injection via filename

MediumPrep Room Coding #1665

Shell injection via filename

Code reviewSecurityMid–Senior~20 min

Review this Python helper that converts an uploaded video.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 20 min

Mark a line and say what kind of problem it is.0 findings

1import subprocess

2

3def make_thumbnail(filename, timestamp):

4 out = filename + '.jpg'

5 cmd = f"ffmpeg -i {filename} -ss {timestamp} -vframes 1 {out}"

6 subprocess.run(cmd, shell=True, check=True)

7 return out

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.