mlcommons / mlcommons/inference
Codebase Refactor: Remove os.system calls
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.6k
- Forks
- 650
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 6
Description
Remove instances where we use os.system instead of shutil and other Python operations to minimize potential security hazards.
Can be automatically checked with ruff's S605 rule, which has the following output on master:
loadgen/docs/src/doxygen_html_generator.py:28:14: S605 Starting a process with a shell, possible injection detected
loadgen/version_generator.py:51:24: S605 Starting a process with a shell, possible injection detected
loadgen/version_generator.py:53:9: S605 Starting a process with a shell, possible injection detected
loadgen/version_generator.py:55:27: S605 Starting a process with a shell, possible injection detected
loadgen/version_generator.py:121:27: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco.py:88:13: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco.py:96:19: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco.py:108:17: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco.py:121:13: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco.py:124:23: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco.py:125:19: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco.py:178:19: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco.py:182:19: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco_calibration.py:70:19: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco_calibration.py:82:17: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco_calibration.py:95:13: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco_calibration.py:98:23: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco_calibration.py:99:19: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco_generate_calibration.py:61:13: S605 Starting a process with a shell, possible injection detected
text_to_image/tools/coco_generate_calibration.py:107:15: S605 Starting a process with a shell, possible injection detected
vision/classification_and_detection/tools/resnet50_tflite_edgetpu.py:62:15: S605 Starting a process with a shell: seems safe, but may be changed in the future; consider rewriting without `shell`
vision/classification_and_detection/tools/resnet50_v1_to_ncnn.py:25:11: S605 Starting a process with a shell: seems safe, but may be changed in the future; consider rewriting without `shell`
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running Ruff's S605 check and review the listed files, including loadgen/version_generator.py, text_to_image/tools/coco.py, and the vision conversion tools. Replace the reported os.system uses with shutil or other Python operations as appropriate, preserving their current behavior. Done means Ruff reports no S605 findings in these locations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security, tooling
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100