6

My Python script has to run binary available only via console, so I use subprocess.run and it looks like this:

CMD = [
    "C:\\Program Files\\Azure DevOps Server 2019\\Tools\\TFSSecurity.exe",
    "/gd",
    f"[{ARGS.projectName}]\\{ARGS.groupName}",
    f"/collection:{ARGS.organization}",
]

DELETE_OUTPUT = subprocess.run(
    CMD, check=True, stdout=subprocess.PIPE, shell=True
).stdout.decode("utf-8")

print(f"[DEBUG] DELETE_OUTPUT: {DELETE_OUTPUT}")

It works fine, but Bandit reports some issues:

[B404:blacklist] Consider possible security implications associated with subprocess module.

[B602:subprocess_popen_with_shell_equals_true] subprocess call with shell=True identified, security issue

Is there a way to run CLI in the more secure way to make Bandit happy?

Martin Thoma
  • 124,992
  • 159
  • 614
  • 958
kagarlickij
  • 7,327
  • 10
  • 36
  • 71
  • 2
    Don't use [shell=True](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess) and it should be happy. As it's [dangerous](https://docs.python.org/2/library/subprocess.html#frequently-used-arguments) – Torxed May 11 '20 at 16:50
  • 1
    Also seeing how you called `subprocess.run()`, there does not seem to be any reason why would you want to run it through `shell`. – Ondrej K. May 11 '20 at 17:15
  • I am also getting same codacy error for subprocess.popen(), I have used shell=False, but still codacy reporting same issue. – MUKHTAR INAMDAR Jan 04 '22 at 05:13

0 Answers0