Run the quickstart block through bash directly, not through a shell - #59
Draft
open-coder-ai-org wants to merge 1 commit into
Draft
Run the quickstart block through bash directly, not through a shell#59open-coder-ai-org wants to merge 1 commit into
open-coder-ai-org wants to merge 1 commit into
Conversation
main is red on semgrep: the row-basis figure generator merged with subprocess.run(..., shell=True), which the security-audit ruleset blocks (python.lang.security.audit.subprocess-shell-true). The block it runs is repo-owned, so this was never an injection risk -- but shell=True propagates the caller's shell settings for no benefit, and a suppressed finding in a repository whose subject is honest verification is the wrong trade. Invokes /bin/bash with an argument list instead. This also picks up -euo pipefail, matching exactly how CI's own quickstart job runs the same block, so a failing line in it now fails the figure generation too. Reproduced the failure offline before fixing it -- the registry is unreachable from this environment, so the rule was reproduced locally: it fires on line 61 of the original, exactly where CI reported it, and is silent on this revision. Both generated figures are byte-identical, 408 tests pass, ruff check and ruff format --check are clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
mainis currently red on semgrep. The row-basis figure generator merged in #57 withsubprocess.run(..., shell=True), which the security-audit ruleset blocks(
python.lang.security.audit.subprocess-shell-true,docs/figures/make_row_basis.py:61). It isthe only blocking finding in the scan.
The block it runs is this repository's own README content, so this was never an injection risk —
but
shell=Truepropagates the caller's shell settings for no benefit here, and carrying asuppressed security finding in a repository whose whole subject is honest verification is the
wrong trade.
This invokes
/bin/bashwith an argument list instead. As a side benefit it picks up-euo pipefail, matching exactly how theQuick start verifiedCI job runs the same block, so afailing line inside it now fails figure generation too rather than passing silently.
# noqa: S603replaces the old# noqa: S602: ruff's S603 fires on anysubprocesscall with anon-literal element, and here that element is
block, read from this repo's own README at thecommit being generated. The comment says so rather than just naming the code.
Verification
The semgrep registry is unreachable from the environment this was fixed in, and a
--quietrunagainst an unreachable registry loads zero rules and reports success — which is not a check
passing, it is a check not running. So the rule was reproduced locally instead:
docs/figures/make_row_basis.py:61, the same line CI reported.Plus: both generated figures byte-identical after regenerating every
docs/figures/make_*.py,408 passed,ruff check .clean,ruff format --check .clean.🤖 Generated with Claude Code