fix: use subprocess instead of os.system in autoban.py - #6

Summary

Fix critical severity security issue in luci-app-ssrserver-python/root/usr/share/ssr/utils/autoban.py.

Vulnerability

Description: The autoban.py script constructs an iptables command by directly interpolating an IP address extracted from log lines into a shell command string using Python's % formatting operator. The IP address is extracted from stdin log lines without any validation. An attacker who can inject malicious content into the log stream can inject shell metacharacters into the IP field, leading to arbitrary command execution when os.system(cmd) is called.

Evidence

Exploitation scenario: An attacker who can inject malicious log entries can craft a log line containing shell metacharacters in the IP address field.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Changes

• luci-app-ssrserver-python/root/usr/share/ssr/utils/autoban.py

Note: The following lines in the same file use a similar pattern and may also need review: luci-app-ssrserver-python/root/usr/share/ssr/utils/autoban.py:56

Behavior Preservation

The change is scoped to 1 file on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

Automated security fix by OrbisAI Security