joystick

#1 [secaudit,blocking,bandit] subprocess with `shell=True`
Closed by puiterwijk. Opened by puiterwijk.

Closed
Reopen Issue

In joystick/consumers/fedora_messaging_consumer.py, line 21, subprocess.Popen is being called with shell=True, without any obvious reason as to why.

Note that bandit (static code analysis required to be run by the Fedora Infra Application Security Policy would have caught this with High confidence and High severity.

Fixed in https://pagure.io/joystick/c/0ac81d6088c6179ccde7f7462e0724e79494389f?branch=master

Metadata Update from @puiterwijk:
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.