mirror of
https://github.com/astral-sh/ruff.git
synced 2025-10-01 14:21:53 +00:00
c2512b4c50
## Summary Closes #17112. Allows passing in string and list-of-strings literals into `subprocess.run` (and related) calls without marking them as untrusted input: ```py import subprocess subprocess.run("true") # "instant" named expressions are also allowed subprocess.run(c := "ls") ``` ## Test Plan Added test cases covering new behavior, passed with `cargo nextest run`.
41 lines
847 B
Python
41 lines
847 B
Python
from subprocess import Popen, call, check_call, check_output, run
|
|
|
|
# Different Popen wrappers are checked.
|
|
a = input()
|
|
Popen(a, shell=False)
|
|
call(a, shell=False)
|
|
check_call(a, shell=False)
|
|
check_output(a, shell=False)
|
|
run(a, shell=False)
|
|
|
|
# Falsey values are treated as false.
|
|
Popen(a, shell=0)
|
|
Popen(a, shell=[])
|
|
Popen(a, shell={})
|
|
Popen(a, shell=None)
|
|
|
|
# Unknown values are treated as falsey.
|
|
Popen(a, shell=True if True else False)
|
|
|
|
# No value is also caught.
|
|
Popen(a)
|
|
|
|
# Literals are fine, they're trusted.
|
|
run("true")
|
|
Popen(["true"])
|
|
Popen("true", shell=False)
|
|
call("true", shell=False)
|
|
check_call("true", shell=False)
|
|
check_output("true", shell=False)
|
|
run("true", shell=False)
|
|
|
|
# Not through assignments though.
|
|
cmd = ["true"]
|
|
run(cmd)
|
|
|
|
# Instant named expressions are fine.
|
|
run(c := "true")
|
|
|
|
# But non-instant are not.
|
|
(e := "echo")
|
|
run(e)
|