refactor: use subprocess.run instead of shell for process invocation#18
Open
deepsource-autofix[bot] wants to merge 2 commits into
Open
refactor: use subprocess.run instead of shell for process invocation#18deepsource-autofix[bot] wants to merge 2 commits into
deepsource-autofix[bot] wants to merge 2 commits into
Conversation
This PR refactors the code to eliminate the use of shell-based process execution and improve security by switching to the subprocess module. All instances of os.system and shell-constructed commands have been replaced with subprocess.run using explicit argument lists and check=True for robust error handling. - Starting a process with a shell detected: Detected use of os.system and shell interpolation leading to potential command injection. The fix adds imports for subprocess, replaces os.system calls with subprocess.run calls that accept a list of arguments, and refactors echo, touch, sam validate, sam build, and sam package commands into list-based invocations. Dynamic option handling (e.g., --debug, --force-upload, --s3-repo) has been moved into Python logic rather than shell concatenation to ensure no untrusted input enters a shell interpreter. > This Autofix was generated by AI. Please review the change before merging.
|
Here's the code health analysis summary for commits Analysis Summary
DeepSource Report Card: C
Focus area: Security — Fix unsanitized S3 object key in `backend/functions/processing/feedback_uploads.py`. Grade capped at C due to critical security issue
|
Added import for random module. Signed-off-by: Sanket Saurav <sanket@deepsource.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR refactors the code to eliminate the use of shell-based process execution and improve security by switching to the subprocess module. All instances of os.system and shell-constructed commands have been replaced with subprocess.run using explicit argument lists and check=True for robust error handling.