From b3d9af4bcdadf774bd4f60818ee4d2d6cfdc786e Mon Sep 17 00:00:00 2001 From: ChuckBuilds Date: Sun, 6 Sep 2026 20:41:13 -0400 Subject: [PATCH] chore: satisfy Codacy's subprocess checks on the new test runner Codacy runs Bandit and Opengrep (its Semgrep fork). The new subprocess.run in scripts/run_plugin_tests.py trips three patterns, on two different lines: Bandit B404 on the import, B603 on the call Opengrep dangerous-subprocess-use-audit on the run( line dangerous-subprocess-use-tainted-env-args on the argv line A nosemgrep applies only to its own line, so the call line and the argv line each need one; a single comment on the call covered neither rule fully. Suppression is the right answer here rather than a rewrite: the interpreter is sys.executable, the arguments are a list, and no shell is involved, so there is nothing to word-split or expand. Matches the pair the rest of the repo already uses for this shape -- permission_utils.py, plugin_loader.py, install_dependencies_apt.py. Codacy: 0 new issues, up to standards. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_014RRtqXDCnvnY6EQwhT5CV9 --- scripts/run_plugin_tests.py | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/scripts/run_plugin_tests.py b/scripts/run_plugin_tests.py index 47b9b851..a8f7f072 100755 --- a/scripts/run_plugin_tests.py +++ b/scripts/run_plugin_tests.py @@ -8,7 +8,7 @@ Supports both unittest and pytest. import os import re -import subprocess # nosec B404 - runs repo-local test files, never a shell +import subprocess # nosec B404 - list-form argv only, no shell # nosemgrep import sys import argparse from pathlib import Path @@ -111,13 +111,16 @@ def run_script_tests(test_files: list, verbose: bool = False) -> int: failures = [] for path in test_files: try: - # nosec B603 - fixed interpreter (sys.executable) plus a test path - # this script discovered by globbing the repo; argument list, no - # shell, so nothing is word-split or expanded. - proc = subprocess.run([sys.executable, str(path)], # nosec B603 - cwd=str(Path(path).parent), - capture_output=True, text=True, env=env, - stdin=subprocess.DEVNULL, timeout=300) + # Fixed interpreter (sys.executable) plus a test path this script + # discovered by globbing the repo; argument list, no shell, so + # nothing is word-split or expanded. Same suppression pair the + # rest of the repo uses for this shape (see permission_utils.py). + proc = subprocess.run( # nosec B603 - no shell invoked (list-form argv) # nosemgrep + [sys.executable, str(path)], # nosemgrep + cwd=str(Path(path).parent), + capture_output=True, text=True, env=env, + stdin=subprocess.DEVNULL, timeout=300, + ) rc = proc.returncode tail = " | ".join((proc.stdout or proc.stderr or "").strip().splitlines()[-2:])[:200] except subprocess.TimeoutExpired: