subprocess call with shell=True identified, security issue.

[mukul-seagate11]

Codacy detected an issue:

Message: subprocess call with shell=True identified, security issue.

Currently on:

• Commit: 12ecf22
• File: scripts/install/opt/seagate/cortx/motr/bin/motr_mini_prov.py
• LineNum: 78

[cortx-admin]

For the convenience of the Seagate development team, this issue has been mirrored in a private Seagate Jira Server: https://jts.seagate.com/browse/CORTX-33346. Note that community members will not be able to access that Jira server but that is not a problem since all activity in that Jira mirror will be copied into this GitHub issue.

[stale]

This issue/pull request has been marked as needs attention as it has been left pending without new activity for 4 days. Tagging @nkommuri @mehjoshi @huanghua78 for appropriate assignment. Sorry for the delay & Thank you for contributing to CORTX. We will get back to you as soon as possible.

[stale]

This issue/pull request has been marked as needs attention as it has been left pending without new activity for 4 days. Tagging @nkommuri @mehjoshi @huanghua78 for appropriate assignment. Sorry for the delay & Thank you for contributing to CORTX. We will get back to you as soon as possible.

[cortx-admin]

Rinku Kothiya commented in Jira Server:

The following pr should address this. 
[https://github.com//pull/2032]

 

[cortx-admin]

Rinku Kothiya commented in Jira Server:

There are 2 new codacy issues after fixing the 2 issues. The new warnings is, "subprocess call - check for execution of untrusted input". According to the below issue it seems that we need to manually ignore this if we think that the input is trusted :
[https://github.com/PyCQA/bandit/issues/333]

[rkothiya]

The pr has been merged.

[cortx-admin]

Rinku Kothiya commented in Jira Server:

set shell=False in the sub process module.

[cortx-admin]

Rinku Kothiya commented in Jira Server:

Patch was reviewed and merged.

[cortx-admin]

Rinku Kothiya commented in Jira Server:

We no longer see the critical warning.

The newly generated low severity warning which was supposed to be manually verified and ignored has been approved for ignoring as commented in pull request and has been ignored and updated in the table.