Potential conflicted rules between S602 and S603
- Dominant language
- Rust
- Stars
- 49.7k
- Forks
- 2.4k
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 458
Description
After bumping ruff from 0.0.261 to 0.0.262, I'm getting conflicted errors from the rules S602 and S603. See below for the minimal code snippet:
```python
from subprocess import PIPE, Popen
proc = Popen(["/foo/bar"], stdout=PIPE, stderr=PIPE, shell=False)
```
I have been setting `shell=False` as per the S602 rule. However, running this snippet with ruff 0.0.262 errors with the S603 rule, which suggests to set `shell=True`. And if I do that, then the code is failing the S602 rule. Would you be able to check and see if this is intentional?
You can find the GitHub Action logs [here](https://github.com/zeshuaro/telegram-pdf-bot/actions/runs/4753738626/jobs/8445683417?pr=1508) with the above error introduced in 0.0.262.
And you can find my ruff config [here](https://github.com/zeshuaro/telegram-pdf-bot/blob/master/pyproject.toml#L58-L112).
Contributor guide
Research direction
Start with the minimal Python subprocess example in the issue and compare Ruff 0.0.261 and 0.0.262 against rules S602 and S603. Trace the rule documentation or implementation for both rules; done when their behavior is consistent and the issue explains whether the diagnostics are intentional or resolves the conflict.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, rust
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100