{"action":"created","issue":{"url":"https://api.github.com/repos/saltstack/salt/issues/30774","repository_url":"https://api.github.com/repos/saltstack/salt","labels_url":"https://api.github.com/repos/saltstack/salt/issues/30774/labels{/name}","comments_url":"https://api.github.com/repos/saltstack/salt/issues/30774/comments","events_url":"https://api.github.com/repos/saltstack/salt/issues/30774/events","html_url":"https://github.com/saltstack/salt/pull/30774","id":130361296,"number":30774,"title":"Added ability to install PKG, DMG and APP files for OS X minions","user":{"login":"opdude","id":312493,"avatar_url":"https://avatars.githubusercontent.com/u/312493?v=3","gravatar_id":"","url":"https://api.github.com/users/opdude","html_url":"https://github.com/opdude","followers_url":"https://api.github.com/users/opdude/followers","following_url":"https://api.github.com/users/opdude/following{/other_user}","gists_url":"https://api.github.com/users/opdude/gists{/gist_id}","starred_url":"https://api.github.com/users/opdude/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/opdude/subscriptions","organizations_url":"https://api.github.com/users/opdude/orgs","repos_url":"https://api.github.com/users/opdude/repos","events_url":"https://api.github.com/users/opdude/events{/privacy}","received_events_url":"https://api.github.com/users/opdude/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/saltstack/salt/labels/OS%20X","name":"OS X","color":"006b75"},{"url":"https://api.github.com/repos/saltstack/salt/labels/Platform","name":"Platform","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-02-01T13:24:23Z","updated_at":"2016-02-02T20:30:49Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/saltstack/salt/pulls/30774","html_url":"https://github.com/saltstack/salt/pull/30774","diff_url":"https://github.com/saltstack/salt/pull/30774.diff","patch_url":"https://github.com/saltstack/salt/pull/30774.patch"},"body":"I realise there was a pkgutil module added recently, but this is a module I've been using for quite a while in our production system and it supports all types of different package installations as well as a state for installing those packages easily."},"comment":{"url":"https://api.github.com/repos/saltstack/salt/issues/comments/178806540","html_url":"https://github.com/saltstack/salt/pull/30774#issuecomment-178806540","issue_url":"https://api.github.com/repos/saltstack/salt/issues/30774","id":178806540,"user":{"login":"cachedout","id":111616,"avatar_url":"https://avatars.githubusercontent.com/u/111616?v=3","gravatar_id":"","url":"https://api.github.com/users/cachedout","html_url":"https://github.com/cachedout","followers_url":"https://api.github.com/users/cachedout/followers","following_url":"https://api.github.com/users/cachedout/following{/other_user}","gists_url":"https://api.github.com/users/cachedout/gists{/gist_id}","starred_url":"https://api.github.com/users/cachedout/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cachedout/subscriptions","organizations_url":"https://api.github.com/users/cachedout/orgs","repos_url":"https://api.github.com/users/cachedout/repos","events_url":"https://api.github.com/users/cachedout/events{/privacy}","received_events_url":"https://api.github.com/users/cachedout/received_events","type":"User","site_admin":false},"created_at":"2016-02-02T20:30:48Z","updated_at":"2016-02-02T20:30:48Z","body":"Hi @opdude \r\n\r\nThere are a number of cases here we we have `python_shell=True`. This makes shell injection a trivial attack. We need to sanitize these commands before passing them into the shell. There are a number of other modules which accomplish this using `shlex.quote`, so you might be able to use those for inspiration. Let me know if I can help. Thanks!"}}