From 910fbea27e82bee91a7e8a646fd6c44722178a59 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 30 Apr 2026 09:34:41 +0200 Subject: [PATCH] fix(security): replace shell=True subprocess calls with list args (B602) - factor.py: check_output([python_bin, path]) instead of shell string - env.py QlibCondaEnv: all four conda commands use list args Shell=True with a constructed string allows shell injection if python_bin or path contain shell metacharacters. Co-Authored-By: Claude Sonnet 4.6 --- rdagent/components/coder/factor_coder/factor.py | 3 +-- rdagent/utils/env.py | 16 +++++++--------- 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/rdagent/components/coder/factor_coder/factor.py b/rdagent/components/coder/factor_coder/factor.py index 398e966e..78dda19a 100644 --- a/rdagent/components/coder/factor_coder/factor.py +++ b/rdagent/components/coder/factor_coder/factor.py @@ -161,8 +161,7 @@ class FactorFBWorkspace(FBWorkspace): try: subprocess.check_output( - f"{FACTOR_COSTEER_SETTINGS.python_bin} {execution_code_path}", - shell=True, + [FACTOR_COSTEER_SETTINGS.python_bin, str(execution_code_path)], cwd=self.workspace_path, stderr=subprocess.STDOUT, timeout=FACTOR_COSTEER_SETTINGS.file_based_execution_timeout, diff --git a/rdagent/utils/env.py b/rdagent/utils/env.py index 55867549..4be77c6d 100644 --- a/rdagent/utils/env.py +++ b/rdagent/utils/env.py @@ -850,24 +850,22 @@ class QlibCondaEnv(LocalEnv[QlibCondaConf]): def prepare(self) -> None: """Prepare the conda environment if not already created.""" try: - envs = subprocess.run("conda env list", capture_output=True, text=True, shell=True) + envs = subprocess.run(["conda", "env", "list"], capture_output=True, text=True) if self.conf.conda_env_name not in envs.stdout: print(f"[yellow]Conda env '{self.conf.conda_env_name}' not found, creating...[/yellow]") subprocess.check_call( - f"conda create -y -n {self.conf.conda_env_name} python=3.10", - shell=True, + ["conda", "create", "-y", "-n", self.conf.conda_env_name, "python=3.10"], ) subprocess.check_call( - f"conda run -n {self.conf.conda_env_name} pip install --upgrade pip cython", - shell=True, + ["conda", "run", "-n", self.conf.conda_env_name, "pip", "install", "--upgrade", "pip", "cython"], ) subprocess.check_call( - f"conda run -n {self.conf.conda_env_name} pip install git+https://github.com/microsoft/qlib.git@2fb9380b342556ddb50a4b24e4fe8655d548b2b8", - shell=True, + ["conda", "run", "-n", self.conf.conda_env_name, "pip", "install", + "git+https://github.com/microsoft/qlib.git@2fb9380b342556ddb50a4b24e4fe8655d548b2b8"], ) subprocess.check_call( - f"conda run -n {self.conf.conda_env_name} pip install catboost xgboost tables torch", - shell=True, + ["conda", "run", "-n", self.conf.conda_env_name, "pip", "install", + "catboost", "xgboost", "tables", "torch"], ) except Exception as e: