[IMP] hw_*: Remove "Shell=True" in subrpocess calls

In the IoT Box, most calls to subprocess used "Shell=True", which can
cause security issues.

--
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

closes odoo/odoo#36088

Signed-off-by: Quentin Lejeune (qle) <qle@odoo.com>

addons/hw_drivers/drivers/PrinterDriver.py

@@ -17,6 +17,7 @@ from PIL import Image, ImageOps
 
 from odoo import http, _
 from odoo.addons.hw_drivers.controllers.driver import event_manager, Driver, PPDs, conn, printers, cups_lock, iot_devices
+from odoo.addons.hw_drivers.tools import helpers
 from odoo.addons.hw_proxy.controllers.main import drivers as old_drivers
 
 _logger = logging.getLogger(__name__)
@@ -245,14 +246,14 @@ class PrinterDriver(Driver):
         homepage = ''
 
         hosting_ap = os.system('pgrep hostapd') == 0
-        ssid = subprocess.check_output('iwconfig 2>&1 | grep \'ESSID:"\' | sed \'s/.*"\\(.*\\)"/\\1/\'', shell=True).decode('utf-8').rstrip()
+        ssid = helpers.get_ssid()
         if hosting_ap:
             with open('/root_bypass_ramdisks/etc/hostapd/hostapd.conf') as config_file:
                 lines = config_file.readlines()
             ssid = lines[1].split("=")[1].replace("\n", "")
-            wlan = 'Wireless network:\n%s\n\n' % ssid
+            wlan = '\nWireless network:\n%s\n\n' % ssid
         elif ssid:
-            wlan = 'Wireless network:\n%s\n\n' % ssid
+            wlan = '\nWireless network:\n%s\n\n' % ssid
 
         interfaces = ni.interfaces()
         ips = []

addons/hw_drivers/tools/helpers.py

@@ -62,6 +62,11 @@ def get_mac_address():
     except:
         return netifaces.ifaddresses('wlan0')[netifaces.AF_LINK][0]['addr']
 
+def get_ssid():
+    process_iwconfig = subprocess.Popen(['iwconfig'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    process_grep = subprocess.Popen(['grep', 'ESSID:"'], stdin=process_iwconfig.stdout, stdout=subprocess.PIPE)
+    return subprocess.check_output(['sed', 's/.*"\\(.*\\)"/\\1/'], stdin=process_grep.stdout).decode('utf-8').rstrip()
+
 def get_odoo_server_url():
     return read_file_first_line('odoo-remote-server.conf')
 

addons/hw_posbox_homepage/controllers/main.py

@@ -63,8 +63,8 @@ class IoTboxHomepage(web.Home):
         hostname = str(socket.gethostname())
         mac = get_mac()
         h = iter(hex(mac)[2:].zfill(12))
-        ssid = subprocess.check_output('iwconfig 2>&1 | grep \'ESSID:"\' | sed \'s/.*"\\(.*\\)"/\\1/\'', shell=True).decode('utf-8').rstrip()
-        wired = subprocess.check_output('cat /sys/class/net/eth0/operstate', shell=True).decode('utf-8').strip('\n')
+        ssid = helpers.get_ssid()
+        wired = subprocess.check_output(['cat', '/sys/class/net/eth0/operstate']).decode('utf-8').strip('\n')
         if wired == 'up':
             network = 'Ethernet'
         elif ssid:

addons/hw_posbox_upgrade/controllers/main.py

@@ -34,7 +34,7 @@ class PosboxUpgrader(hw_proxy.Proxy):
 
     @http.route('/hw_proxy/upgrade', type='http', auth='none', )
     def upgrade(self):
-        commit = subprocess.check_output("git --work-tree=/home/pi/odoo/ --git-dir=/home/pi/odoo/.git log -1", shell=True).decode('utf-8').replace("\n", "<br/>")
+        commit = subprocess.check_output(["git", "--work-tree=/home/pi/odoo/", "--git-dir=/home/pi/odoo/.git", "log", "-1"]).decode('utf-8').replace("\n", "<br/>")
         return upgrade_page_template.render({
             'title': "Odoo's IoTBox - Software Upgrade",
             'breadcrumb': 'IoT Box Software Upgrade',

addons/hw_proxy/controllers/main.py

@@ -127,7 +127,7 @@ class Proxy(http.Controller):
                 %s
                 </pre>
 
-            """ % subprocess.check_output('lsusb -v', shell=True).decode('utf-8')
+            """ % subprocess.check_output(['lsusb', '-v']).decode('utf-8')
 
         return request.make_response(resp,{
             'Cache-Control': 'no-cache',