Subprocess usage flagging
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 835
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
Issue: [B404:blacklist] Consider possible security implications associated with subprocess module.
On
import subprocess
and
Issue: [B603:subprocess_without_shell_equals_true] subprocess call - check for execution of untrusted input.
On
result = subprocess.call(args, shell=False)
Expected behavior
Is that expected behaviour to flag import of subprocess module and also flag call function with shell=False ?
Bandit version
➜ bandit --version
bandit 1.5.1
python version = 2.7.15 (default, Aug 17 2018, 22:39:05) [GCC 4.2.1 Compatible Apple LLVM 9.1.0 (clang-902.0.39.2)]
Additional context
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the two snippets with Bandit 1.5.1 through the bandit command, focusing on the B404 and B603 checks described in the issue. Review whether each warning is expected for import subprocess and subprocess.call(..., shell=False); done means the intended behavior is established and covered by the relevant check tests or documentation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100