checks: Mark justified partial-path subprocess calls as nosec B607

locale/grass_po_stats.py

@@ -109,7 +109,7 @@ def get_stats(languages, directory):
             fpref = flang.split("_")[0]
             # run msgfmt for statistics
             # TODO check if it's working on windows
-            process = subprocess.Popen(
+            process = subprocess.Popen(  # nosec B607: fixed external tool "msgfmt" with no portable absolute path
                 ["msgfmt", "--statistics", os.path.join(directory, flang)],
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,

python/grass/gunittest/reporters.py

@@ -174,7 +174,7 @@ def get_svn_revision():
     """
     # TODO: here should be starting directory
     # but now we are using current as starting
-    with subprocess.Popen(
+    with subprocess.Popen(  # nosec B607: fixed external tool "svnversion" with no portable absolute path
         ["svnversion", "."], stdout=subprocess.PIPE, stderr=subprocess.PIPE
     ) as p:
         stdout, stderr = p.communicate()
@@ -197,7 +197,7 @@ def get_svn_info():
     """
     try:
         # TODO: introduce directory, not only current
-        with subprocess.Popen(
+        with subprocess.Popen(  # nosec B607: fixed external tool "svn" with no portable absolute path
             ["svn", "info", ".", "--xml"],
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
@@ -252,7 +252,7 @@ def get_svn_path_authors(path, from_date=None):
     revision_range = "BASE:1" if from_date is None else "BASE:{%s}" % from_date
     try:
         # TODO: allow also usage of --limit
-        with subprocess.Popen(
+        with subprocess.Popen(  # nosec B607: fixed external tool "svn" with no portable absolute path
             ["svn", "log", "--xml", "--revision", revision_range, path],
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,

scripts/g.manual/g.manual.py

@@ -121,7 +121,7 @@ def start_man(entry):
 
     for ext in ["", ".gz", ".bz2"]:
         if Path(path + ext).exists():
-            os.execlp("man", "man", path + ext)
+            os.execlp("man", "man", path + ext)  # nosec B607: runs the user's system "man" (PATH lookup intended)
             grass.fatal(_("Error starting 'man' for '%s'") % path)
     grass.fatal(_("No manual page entry for '%s'") % entry)
 

utils/coverage_mapper.py

@@ -6,7 +6,7 @@
 def get_grass_config_path():
     grass_config_path = None
     try:
-        grass_config_path = subprocess.run(
+        grass_config_path = subprocess.run(  # nosec B607: fixed external tool "grass" with no portable absolute path
             ["grass", "--config", "path"], capture_output=True, text=True, check=True
         ).stdout.rstrip()
     except OSError:

utils/generate_last_commit_file.py

@@ -56,7 +56,7 @@ def get_last_commit(src_dir):
         if ".html{}".format(join_sep) not in join_sep.join(files) + join_sep:
             continue
         rel_path = os.path.relpath(root)
-        process_result = subprocess.run(
+        process_result = subprocess.run(  # nosec B607: fixed external tool "git" with no portable absolute path
             [
                 "git",
                 "log",

utils/generate_release_notes.py

@@ -154,7 +154,7 @@ def adjust_after(lines):
             username = username.replace("@", "")
             if username in known_bot_names:
                 continue
-            output = subprocess.run(
+            output = subprocess.run(  # nosec B607: fixed external tool "gh" with no portable absolute path
                 ["gh", "api", f"users/{username}"],
                 capture_output=True,
                 text=True,
@@ -203,7 +203,7 @@ def print_notes(
 
 def notes_from_gh_api(start_tag, end_tag, branch, categories, exclude):
     """Generate notes from GitHub API"""
-    text = subprocess.run(
+    text = subprocess.run(  # nosec B607: fixed external tool "gh" with no portable absolute path
         [
             "gh",
             "api",
@@ -255,7 +255,7 @@ def csv_to_dict(filename, key, value):
 
 def notes_from_git_log(start_tag, end_tag, categories, exclude):
     """Generate notes from git log"""
-    text = subprocess.run(
+    text = subprocess.run(  # nosec B607: fixed external tool "git" with no portable absolute path
         ["git", "log", f"{start_tag}..{end_tag}", f"--pretty=format:{PRETTY_TEMPLATE}"],
         capture_output=True,
         text=True,
@@ -337,7 +337,7 @@ def create_release_notes(args):
     end_tag = args.end_tag
     if not end_tag:
         # git log has default, but the others do not.
-        end_tag = subprocess.run(
+        end_tag = subprocess.run(  # nosec B607: fixed external tool "git" with no portable absolute path
             ["git", "rev-parse", "--verify", "HEAD"],
             capture_output=True,
             text=True,

utils/md_isvalid.py

@@ -14,7 +14,7 @@
 
 
 def check_md(filename):
-    with subprocess.Popen(["mdl", filename]) as p:
+    with subprocess.Popen(["mdl", filename]) as p:  # nosec B607: fixed external tool "mdl" with no portable absolute path
         p.wait()
 
 
@@ -29,7 +29,7 @@ def check_module(module):
     with open(tmp_file, "w") as fp:
         with subprocess.Popen([module, "--md-description"], stdout=fp) as p:
             p.wait()
-        with subprocess.Popen(
+        with subprocess.Popen(  # nosec B607: fixed external tool "mdl" with no portable absolute path
             [
                 "mdl",
                 "--style",

utils/mkdocs.py

@@ -73,7 +73,7 @@ def get_version_branch(major_version, addons_git_repo_url):
     """
     version_branch = f"grass{major_version}"
     if source_is_remote():
-        branch = subprocess.Popen(
+        branch = subprocess.Popen(  # nosec B607: fixed external tool "git" with no portable absolute path
             [
                 "git",
                 "ls-remote",
@@ -110,7 +110,7 @@ def has_src_code_git(src_dir):
     actual_dir = Path.cwd()
     os.chdir(src_dir)
     try:
-        process_result = subprocess.run(
+        process_result = subprocess.run(  # nosec B607: fixed external tool "git" with no portable absolute path
             [
                 "git",
                 "log",
@@ -399,7 +399,7 @@ def get_addon_path(base_url, pgm, major_version):
         try:
             with tempfile.TemporaryDirectory(dir=addons_base_dir) as tmpdir:
                 tmp_clone_path = Path(tmpdir) / "grass-addons"
-                subprocess.call(
+                subprocess.call(  # nosec B607: fixed external tool "git" with no portable absolute path
                     [
                         "git",
                         "clone",
@@ -415,7 +415,7 @@ def get_addon_path(base_url, pgm, major_version):
         except (shutil.Error, OSError):
             if not grass_addons_dir.exists():
                 raise
-    addons_file_list = subprocess.Popen(
+    addons_file_list = subprocess.Popen(  # nosec B607: fixed external tool "git" with no portable absolute path
         ["git", "ls-tree", "--name-only", "-r", addons_branch],
         cwd=grass_addons_dir,
         stdout=subprocess.PIPE,