mirrors/ruff
1
0
Fork 0
mirror of https://github.com/astral-sh/ruff.git synced 2025-10-02 06:41:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

[flake8-bandit] Fix truthiness: dict-only ** displays not truthy for shell (S602, S604, S609) (#20177)

Browse source 
## Summary
Fixes #19927
This commit is contained in:
Dan Parizher 2025-09-10 17:06:33 -04:00 • committed by GitHub
parent cde5e4e343
commit 4c64ba4ee1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 42 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

15
crates/ruff_linter/resources/test/fixtures/flake8_bandit/S602.py vendored
View file

@ -18,3 +18,18 @@ var_string = "true"
Popen(var_string, shell=True)
Popen([var_string], shell=True)
Popen([var_string, ""], shell=True)
# Check dict display with only double-starred expressions can be falsey.
Popen("true", shell={**{}})
Popen("true", shell={**{**{}}})
# Check pattern with merged defaults/configs
class ShellConfig:
def __init__(self):
self.shell_defaults = {}
def fetch_shell_config(self, username):
return {}
def run(self, username):
Popen("true", shell={**self.shell_defaults, **self.fetch_shell_config(username)})

3
crates/ruff_linter/resources/test/fixtures/flake8_bandit/S604.py vendored
View file

@ -3,3 +3,6 @@ def foo(shell):
foo(shell=True)
foo(shell={**{}})
foo(shell={**{**{}}})

3
crates/ruff_linter/resources/test/fixtures/flake8_bandit/S609.py vendored
View file

@ -6,3 +6,6 @@ subprocess.Popen("/bin/chown root: *", shell=True)
subprocess.Popen(["/usr/local/bin/rsync", "*", "some_where:"], shell=True)
subprocess.Popen("/usr/local/bin/rsync * no_injection_here:")
os.system("tar cf foo.tar bar/*")
subprocess.Popen(["chmod", "+w", "*.py"], shell={**{}})
subprocess.Popen(["chmod", "+w", "*.py"], shell={**{**{}}})

2
crates/ruff_linter/src/rules/flake8_bandit/snapshots/ruff_linter__rules__flake8_bandit__tests__S602_S602.py.snap
View file

@ -124,4 +124,6 @@ S602 `subprocess` call with `shell=True` identified, security issue
19 | Popen([var_string], shell=True)
20 | Popen([var_string, ""], shell=True)
| ^^^^^
21 |
22 | # Check dict display with only double-starred expressions can be falsey.
|

2
crates/ruff_linter/src/rules/flake8_bandit/snapshots/ruff_linter__rules__flake8_bandit__tests__S604_S604.py.snap
View file

@ -6,4 +6,6 @@ S604 Function call with `shell=True` parameter identified, security issue
|
5 | foo(shell=True)
| ^^^
6 |
7 | foo(shell={**{}})
|

2
crates/ruff_linter/src/rules/flake8_bandit/snapshots/ruff_linter__rules__flake8_bandit__tests__S609_S609.py.snap
View file

@ -40,4 +40,6 @@ S609 Possible wildcard injection in call due to `*` usage
7 | subprocess.Popen("/usr/local/bin/rsync * no_injection_here:")
8 | os.system("tar cf foo.tar bar/*")
| ^^^^^^^^^^^^^^^^^^^^^^
9 |
10 | subprocess.Popen(["chmod", "+w", "*.py"], shell={**{}})
|

17
crates/ruff_python_ast/src/helpers.rs
View file

@ -1294,15 +1294,14 @@ impl Truthiness {
return Self::Falsey;
}
if dict.items.iter().all(|item| {
matches!(
item,
DictItem {
key: None,
value: Expr::Name(..)
}
)
}) {
// If the dict consists only of double-starred items (e.g., {**x, **y}),
// consider its truthiness unknown. This matches lists/sets/tuples containing
// only starred elements, which are also Unknown.
if dict
.items
.iter()
.all(|item| matches!(item, DictItem { key: None, .. }))
{
// {**foo} / {**foo, **bar}
Self::Unknown
} else {