astral-sh / astral-sh/ruff

Potential conflicted rules between S602 and S603

Open
#4,045 16 comments 2 reactions 0 assignees View on GitHub
needs-decision rule
Dominant language
Rust
Stars
49.7k
Forks
2.4k
Avg merge
2d 1h
Merged PRs (30d)
458

Description

After bumping ruff from 0.0.261 to 0.0.262, I'm getting conflicted errors from the rules S602 and S603. See below for the minimal code snippet:

```python
from subprocess import PIPE, Popen

proc = Popen(["/foo/bar"], stdout=PIPE, stderr=PIPE, shell=False)
```

I have been setting `shell=False` as per the S602 rule. However, running this snippet with ruff 0.0.262 errors with the S603 rule, which suggests to set `shell=True`. And if I do that, then the code is failing the S602 rule. Would you be able to check and see if this is intentional?

You can find the GitHub Action logs [here](https://github.com/zeshuaro/telegram-pdf-bot/actions/runs/4753738626/jobs/8445683417?pr=1508) with the above error introduced in 0.0.262.

And you can find my ruff config [here](https://github.com/zeshuaro/telegram-pdf-bot/blob/master/pyproject.toml#L58-L112).

Contributor guide

Open the contributing guide

Research direction

Start with the minimal Python subprocess example in the issue and compare Ruff 0.0.261 and 0.0.262 against rules S602 and S603. Trace the rule documentation or implementation for both rules; done when their behavior is consistent and the issue explains whether the diagnostics are intentional or resolves the conflict.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, rust
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.