Suppress bandit B602 false positive in admin CLI tool
subprocess shell=True is intentional: cmd is a ceph/SSH command built internally, not from untrusted user input. Admin-only tool. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -37,7 +37,7 @@ def run_command(cmd, parse_json=False, host=None):
|
|||||||
if DEBUG:
|
if DEBUG:
|
||||||
print(f"{Colors.CYAN}DEBUG: Running: {cmd}{Colors.END}")
|
print(f"{Colors.CYAN}DEBUG: Running: {cmd}{Colors.END}")
|
||||||
|
|
||||||
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, check=True)
|
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, check=True) # nosec B602 — admin-only CLI tool; cmd is ceph/ssh commands built internally
|
||||||
if parse_json:
|
if parse_json:
|
||||||
return json.loads(result.stdout)
|
return json.loads(result.stdout)
|
||||||
return result.stdout.strip()
|
return result.stdout.strip()
|
||||||
|
|||||||
Reference in New Issue
Block a user