rick/LEDMatrix
1
0
Fork 0
mirror of https://github.com/ChuckBuilds/LEDMatrix.git synced 2026-10-10 17:16:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(web): only ask systemctl about known units

Browse Source 
Codacy flagged the systemctl argv built from a variable. The unit now has
to be one of two literals, and anything else raises.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Chuck
2026-09-23 17:13:10 -04:00
co-authored by Claude Opus 5.5
parent b93827bc99
commit 8eb04dcae7
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web_interface/app.py
+7 -1
View File
@@ -303,19 +303,25 @@ _service_status_cache = TTLCache()
_AP_MODE_CACHE_TTL = 30 # seconds — AP mode is user-initiated; 30s is fine _AP_MODE_CACHE_TTL = 30 # seconds — AP mode is user-initiated; 30s is fine
_LEDMATRIX_SERVICE_CACHE_TTL = 15 # seconds _LEDMATRIX_SERVICE_CACHE_TTL = 15 # seconds
# The only units _unit_is_active() may ask systemctl about: its argv is built
# from these literals, never from request data.
_CHECKABLE_UNITS = frozenset({'hostapd', 'ledmatrix'})
def _unit_is_active(unit, ttl): def _unit_is_active(unit, ttl):
"""`systemctl is-active <unit>`, cached for ``ttl`` seconds. """`systemctl is-active <unit>`, cached for ``ttl`` seconds.
False where there is no systemctl (a dev machine); on a failed check, the False where there is no systemctl (a dev machine); on a failed check, the
last known answer. last known answer.
""" """
if unit not in _CHECKABLE_UNITS:
raise ValueError(f"not a checkable unit: {unit!r}")
active = _service_status_cache.get(unit) active = _service_status_cache.get(unit)
if active is not None: if active is not None:
return active return active
active = _service_status_cache.peek(unit, False) active = _service_status_cache.peek(unit, False)
if _SYSTEMCTL: if _SYSTEMCTL:
try: try:
result = subprocess.run([_SYSTEMCTL, 'is-active', unit], result = subprocess.run([_SYSTEMCTL, 'is-active', unit], # nosec B603 - list argv, unit is from _CHECKABLE_UNITS # nosemgrep
capture_output=True, text=True, timeout=2) capture_output=True, text=True, timeout=2)
active = result.stdout.strip() == 'active' active = result.stdout.strip() == 'active'
except (subprocess.SubprocessError, OSError) as e: except (subprocess.SubprocessError, OSError) as e: