A static security scan (bandit, high-severity / high-confidence only, manually verified against source to drop literal-argument false positives) found 1 item(s) worth review:
- B602 (subprocess with shell=True) -
fleet/harness.py:29
return subprocess.run(rest, shell=True, capture_output=True, text=True, timeout=60).stdout[:4000]
Why it matters: these are points where untrusted input could reach a shell, deserializer, or query, or where a secret/weak primitive is used.
Suggested remediation: pass argument lists to subprocess with shell=False; replace os.system with subprocess.run([...]); use yaml.safe_load, parameterized queries, and hashlib only for non-security digests.
Generated by an automated audit; each item links to a real line - please confirm intent before closing.
A static security scan (
bandit, high-severity / high-confidence only, manually verified against source to drop literal-argument false positives) found 1 item(s) worth review:fleet/harness.py:29Why it matters: these are points where untrusted input could reach a shell, deserializer, or query, or where a secret/weak primitive is used.
Suggested remediation: pass argument lists to
subprocesswithshell=False; replaceos.systemwithsubprocess.run([...]); useyaml.safe_load, parameterized queries, andhashlibonly for non-security digests.Generated by an automated audit; each item links to a real line - please confirm intent before closing.