Don't run Commands from AWS::CloudFormation::Init on shell when given as list

[Anant Patil]

When the commands are given as list in AWS::CloudFormation::Init, just run them without using the shell. By default, the external commands (commands either from AWS::CloudFormation::Init or cfn-hooks) are run on shell. Usually these commands are given as if typed on a shell. But in case the command given in AWS::CloudFormation::Init is supplied as a list, it should be run without shell.

[Anant Patil (ananta)]

Reference: https://review.openstack.org/#/c/222554/2..4/heat_cfntools/cfntools/cfn_helper.py

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/226631
Committed: https://git.openstack.org/cgit/openstack/heat-cfntools/commit/?id=6571e5ab646f55ba9411f5a668c5224203a08707
Submitter: Jenkins
Branch: master

commit 6571e5ab646f55ba9411f5a668c5224203a08707
Author: Anant Patil <email address hidden>
Date: Wed Sep 23 11:56:05 2015 +0530

    Don't run commands given as list on shell

    Commands from AWS::CloudFormation::Init, when supplied as list, should
    be run with shell=False. Only when commands are given as string, they
    are meant to be run on shell.

    In principle, we are trying to give least access to the shell to avoid
    any inadvertent shell injections.

    Change-Id: I3dc6fe0c29a14f75be044846f737e1ade23a6d6b
    Closes-Bug: 1498300