gavindiaz/NexQuant
1
0
Fork 0
mirror of https://github.com/NicolasBohn/NexQuant.git synced 2026-07-27 23:47:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): replace shell=True subprocess calls with list args (B602)

Browse Source 
- factor.py: check_output([python_bin, path]) instead of shell string
- env.py QlibCondaEnv: all four conda commands use list args

Shell=True with a constructed string allows shell injection if
python_bin or path contain shell metacharacters.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
TPTBusiness
2026-04-30 09:34:41 +02:00
parent a076b58304
commit 0fa4f5dcc8
2 changed files with 8 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rdagent/components/coder/factor_coder/factor.py
+1 -2
View File
@@ -161,8 +161,7 @@ class FactorFBWorkspace(FBWorkspace):
try:
subprocess.check_output(
f"{FACTOR_COSTEER_SETTINGS.python_bin} {execution_code_path}",
shell=True,
[FACTOR_COSTEER_SETTINGS.python_bin, str(execution_code_path)],
cwd=self.workspace_path,
stderr=subprocess.STDOUT,
timeout=FACTOR_COSTEER_SETTINGS.file_based_execution_timeout,
rdagent/utils/env.py
+7 -9
View File
@@ -850,24 +850,22 @@ class QlibCondaEnv(LocalEnv[QlibCondaConf]):
def prepare(self) -> None:
"""Prepare the conda environment if not already created."""
try:
envs = subprocess.run("conda env list", capture_output=True, text=True, shell=True)
envs = subprocess.run(["conda", "env", "list"], capture_output=True, text=True)
if self.conf.conda_env_name not in envs.stdout:
print(f"[yellow]Conda env '{self.conf.conda_env_name}' not found, creating...[/yellow]")
subprocess.check_call(
f"conda create -y -n {self.conf.conda_env_name} python=3.10",
shell=True,
["conda", "create", "-y", "-n", self.conf.conda_env_name, "python=3.10"],
)
subprocess.check_call(
f"conda run -n {self.conf.conda_env_name} pip install --upgrade pip cython",
shell=True,
["conda", "run", "-n", self.conf.conda_env_name, "pip", "install", "--upgrade", "pip", "cython"],
)
subprocess.check_call(
f"conda run -n {self.conf.conda_env_name} pip install git+https://github.com/microsoft/qlib.git@2fb9380b342556ddb50a4b24e4fe8655d548b2b8",
shell=True,
["conda", "run", "-n", self.conf.conda_env_name, "pip", "install",
"git+https://github.com/microsoft/qlib.git@2fb9380b342556ddb50a4b24e4fe8655d548b2b8"],
)
subprocess.check_call(
f"conda run -n {self.conf.conda_env_name} pip install catboost xgboost tables torch",
shell=True,
["conda", "run", "-n", self.conf.conda_env_name, "pip", "install",
"catboost", "xgboost", "tables", "torch"],
)
except Exception as e: