Suppress bandit B602 false positive in admin CLI tool
subprocess shell=True is intentional: cmd is a ceph/SSH command built internally, not from untrusted user input. Admin-only tool. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -37,7 +37,7 @@ def run_command(cmd, parse_json=False, host=None):
|
||||
if DEBUG:
|
||||
print(f"{Colors.CYAN}DEBUG: Running: {cmd}{Colors.END}")
|
||||
|
||||
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, check=True)
|
||||
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, check=True) # nosec B602 — admin-only CLI tool; cmd is ceph/ssh commands built internally
|
||||
if parse_json:
|
||||
return json.loads(result.stdout)
|
||||
return result.stdout.strip()
|
||||
|
||||
Reference in New Issue
Block a user