codemod to set shell=False for subprocess commands

[clavedeluna]

Overview

Codemod that checks any of the subprocess functions / class instantiations that have a shell kwarg and ensures it is set to True

This is the most secure fix, but there are some valid cases for using shell=True hence the review guidance.

[codecov]

Codecov Report

Attention: 1 lines in your changes are missing coverage. Please review.

Comparison is base (a91eb5a) 96.35% compared to head (b673e03) 96.34%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #193      +/-   ##
==========================================
- Coverage   96.35%   96.34%   -0.01%     
==========================================
  Files          82       83       +1     
  Lines        3837     3860      +23     
==========================================
+ Hits         3697     3719      +22     
- Misses        140      141       +1     

Files	Coverage Δ
src/core_codemods/__init__.py	100.00% <100.00%> (ø)
src/core_codemods/subprocess_shell_false.py	95.45% <95.45%> (ø)

[drdavella]

Looks good but I have some requests for updates to metadata.

Also there's the question of whether this should be retroactively applied to our own security API.

[sonarqubecloud]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud