Как устранить проблемы безопасности, отмеченные Bandit для использования subprocess.Popen() в Python? ⇐ Python

[Anonymous]

Я работаю над сценарием Python, который использует subprocess.Popen() для выполнения файла JAR. Когда я запускаю Bandit, инструмент статического анализа безопасности, он отмечает проблемы безопасности при таком использовании. В частности, здесь освещаются такие проблемы, как использование модуля подпроцесса, запуск процесса с частичным путем и вызов подпроцесса без Shell=True.
Вот фрагмент код:
def run_test():
"""Launches the test."""
try:
subprocess.Popen(["java", "-jar", "resources\\test.jar"])
except Exception as e:
print(f"Error running test: {e}")

Bandit Messages:
--------------------------------------------------
>> Issue: [B404:blacklist] Consider possible security implications associated with the subprocess module.
Severity: Low Confidence: High
CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
More Info: https://bandit.readthedocs.io/en/1.7.8/ ... subprocess
7 import platform
8 import subprocess
9 import os
--------------------------------------------------
>> Issue: [B607:start_process_with_partial_path] Starting a process with a partial executable path
Severity: Low Confidence: High
CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
More Info: https://bandit.readthedocs.io/en/1.7.8/ ... _path.html
24 try:
25 subprocess.Popen(["java", "-jar", "resources\test.jar"])
26 except Exception as e:

--------------------------------------------------
>> Issue: [B603:subprocess_without_shell_equals_true] subprocess call - check for execution of untrusted input.
Severity: Low Confidence: High
CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
More Info: https://bandit.readthedocs.io/en/1.7.8/ ... _true.html
24 try:
25 subprocess.Popen(["java", "-jar", "resources\test.jar"])
26 except Exception as e:

--------------------------------------------------

I understand the importance of addressing these security concerns. However, I need to use **subprocess.Popen()** to execute the JAR file. What is the best way to handle these security issues flagged by Bandit while maintaining the functionality of my code?

Any insights or suggestions would be greatly appreciated. Thank you.



Подробнее здесь: https://stackoverflow.com/questions/781 ... n-usage-in