From 0a44b06b6d0d62ee8dbdc302ba39658759f0e9bc Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 21 Mar 2026 04:00:05 +0000
Subject: [PATCH] Fix command injection vulnerability in subprocess calls.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 app/tasks/convert_to_pdfa.py            | 1 +
 app/tasks/upload_to_user_integration.py | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/app/tasks/convert_to_pdfa.py b/app/tasks/convert_to_pdfa.py
index b94ae74a..6def4d24 100644
--- a/app/tasks/convert_to_pdfa.py
+++ b/app/tasks/convert_to_pdfa.py
@@ -78,6 +78,7 @@ def _convert_pdf_to_pdfa(input_path: str, output_path: str, pdfa_format: str = "
         output_type,
         "--quiet",
         "--invalidate-digital-signatures",
+        "--",
         input_path,
         output_path,
     ]
diff --git a/app/tasks/upload_to_user_integration.py b/app/tasks/upload_to_user_integration.py
index 1b23d321..9654fb5c 100644
--- a/app/tasks/upload_to_user_integration.py
+++ b/app/tasks/upload_to_user_integration.py
@@ -555,8 +555,9 @@ def _upload_rclone(file_path: str, cfg: dict[str, Any], creds: dict[str, Any], t
     dest = dest.replace("//", "/")
 
     try:
+        # SECURITY: Separate options from positional arguments using -- to prevent command injection
         result = subprocess.run(  # nosec B603  # noqa: S603 S607
-            ["rclone", "copyto", f"--config={conf_path}", file_path, dest],  # noqa: S603 S607
+            ["rclone", "copyto", f"--config={conf_path}", "--", file_path, dest],  # noqa: S603 S607
             capture_output=True,
             text=True,
             timeout=300,