avoid passing open network connections to subprocesses, call Popen with close_fds=True

pandora/archive/extract.py

@@ -50,12 +50,12 @@ class AspectRatio(fractions.Fraction):
 
 def supported_formats():
     p = subprocess.Popen(['which', AVCONV],
-            stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=True)
     stdout, stderr = p.communicate()
     if not stdout.strip():
         return None
     p = subprocess.Popen([AVCONV, '-codecs'],
-            stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=True)
     stdout, stderr = p.communicate()
     return {
         'ogg': 'libtheora' in stdout and 'libvorbis' in stdout,
@@ -65,7 +65,7 @@ def supported_formats():
 
 def avconv_version():
     p = subprocess.Popen([AVCONV],
-            stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=True)
     stdout, stderr = p.communicate()
     version = stderr.split(' ')[2].split('-')[0]
     return version
@@ -287,7 +287,8 @@ def stream(video, target, profile, info, avconv=None, audio_track=0):
     #print cmd
     p = subprocess.Popen(cmd, stdin=subprocess.PIPE,
                               stdout=subprocess.PIPE,
-                              stderr=subprocess.STDOUT)
+                              stderr=subprocess.STDOUT,
+                              close_fds=True)
     stdout, stderr = p.communicate()
 
     if p.returncode != 0:
@@ -301,7 +302,8 @@ def stream(video, target, profile, info, avconv=None, audio_track=0):
         #print cmd
         p = subprocess.Popen(cmd, stdin=subprocess.PIPE,
                                   stdout=open('/dev/null', 'w'),
-                                  stderr=subprocess.STDOUT)
+                                  stderr=subprocess.STDOUT,
+                                  close_fds=True)
         p.communicate()
         os.unlink("%s.mp4" % target)
     return True, None
@@ -310,7 +312,8 @@ def stream(video, target, profile, info, avconv=None, audio_track=0):
 def run_command(cmd, timeout=10):
     #print cmd
     p = subprocess.Popen(cmd, stdout=open('/dev/null', 'w'),
-                              stderr=subprocess.STDOUT)
+                              stderr=subprocess.STDOUT,
+                              close_fds=True)
     while timeout > 0:
         time.sleep(0.2)
         timeout -= 0.2
@@ -412,7 +415,8 @@ def timeline(video, prefix, modes=None, size=None):
         '-c', os.path.join(prefix, 'cuts.json'),
     ] + video
     p = subprocess.Popen(cmd, stdin=subprocess.PIPE,
-        stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+        stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+        close_fds=True)
     #print cmd
     #p = subprocess.Popen(cmd)
     p.wait()
@@ -569,7 +573,8 @@ def chop(video, start, end):
     ]
     p = subprocess.Popen(cmd, stdin=subprocess.PIPE,
                               stdout=open('/dev/null', 'w'),
-                              stderr=open('/dev/null', 'w'))
+                              stderr=open('/dev/null', 'w'),
+                              close_fds=True)
     p.wait()
     f = open(choped_video, 'r')
     os.unlink(choped_video)

pandora/document/models.py

@@ -4,7 +4,6 @@ from __future__ import division, with_statement
 import os
 import re
 from glob import glob
-import subprocess
 from urllib import quote, unquote
 
 from django.db import models

pandora/document/utils.py

@@ -8,7 +8,7 @@ def pdfpages(pdf):
 
 def pdfinfo(pdf):
     cmd = ['pdfinfo', pdf]
-    p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=True)
     stdout, stderr = p.communicate()
     data = {}
     for line in stdout.strip().split('\n'):
@@ -22,6 +22,6 @@ def extract_pdfpage(pdf, image, page):
     page -= 1
     cmd = ['convert', '%s[%d]' % (pdf, page),
         '-background', 'white', '-flatten', '-resize', '1024x1024', image]
-    p = subprocess.Popen(cmd)
+    p = subprocess.Popen(cmd, close_fds=True)
     p.wait()
     return image

pandora/edit/models.py

@@ -271,7 +271,7 @@ class Edit(models.Model):
                 '-f', ','.join(frames),
                 '-o', icon
             ]
-            p = subprocess.Popen(cmd)
+            p = subprocess.Popen(cmd, close_fds=True)
             p.wait()
             self.save()
 
@@ -355,12 +355,12 @@ class Edit(models.Model):
                    '-ss', data['in'], '-t', data['out'],
                    '-vcodec', 'copy', '-acodec', 'copy',
                     clips[-1]]
-            #p = subprocess.Popen(cmd)
+            #p = subprocess.Popen(cmd, close_fds=True)
             #p.wait()
         cmd = ['mkvmerge', clips[0]] \
             + ['+'+c for c in clips[1:]] \
             + [os.path.join(tmp, 'render.webm')]
-        #p = subprocess.Popen(cmd)
+        #p = subprocess.Popen(cmd, close_fds=True)
         #p.wait()
         shutil.rmtree(tmp)
 

pandora/item/models.py

@@ -462,7 +462,7 @@ class Item(models.Model):
                 first = True
                 cmd = ['mkvmerge', '-o', output]
                 cmd += [streams[0]] + ['+' + s for s in streams[1:]]
-                p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+                p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=True)
                 p.wait()
                 return True
             elif format == "mp4":
@@ -470,7 +470,7 @@ class Item(models.Model):
                 shutil.copy(streams[0], tmp_output)
                 for s in streams[1:]:
                     cmd = ['MP4Box', '-cat', s, tmp_output]
-                    p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+                    p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=True)
                     p.wait()
                 shutil.copy(tmp_output, output)
                 os.unlink(tmp_output)
@@ -1367,7 +1367,7 @@ class Item(models.Model):
             data['timeline'] = timeline
         data['oxdbId'] = self.oxdbId or self.oxdb_id() or self.itemId
         ox.makedirs(os.path.join(settings.MEDIA_ROOT,self.path()))
-        p = subprocess.Popen(cmd, stdin=subprocess.PIPE)
+        p = subprocess.Popen(cmd, stdin=subprocess.PIPE, close_fds=True)
         p.communicate(json.dumps(data, default=fields.to_json))
         for f in glob(poster.replace('.jpg', '*.jpg')):
             if f != poster:
@@ -1442,7 +1442,7 @@ class Item(models.Model):
            cmd += ['-l', timeline]
         if frame:
            cmd += ['-f', frame]
-        p = subprocess.Popen(cmd)
+        p = subprocess.Popen(cmd, close_fds=True)
         p.wait()
         #remove cached versions
         icon = os.path.abspath(os.path.join(settings.MEDIA_ROOT, icon))

pandora/itemlist/models.py

@@ -257,7 +257,7 @@ class List(models.Model):
                 '-f', ','.join(frames),
                 '-o', icon
             ]
-            p = subprocess.Popen(cmd)
+            p = subprocess.Popen(cmd, close_fds=True)
             p.wait()
             self.save()
 

pandora/text/models.py

@@ -255,7 +255,7 @@ class Text(models.Model):
                 '-f', ','.join(frames),
                 '-o', icon
             ]
-            p = subprocess.Popen(cmd)
+            p = subprocess.Popen(cmd, close_fds=True)
             p.wait()
             self.save()