Skip to content

subprocess-without-shell-equals-true (S603)

Added in v0.0.262 · Related issues · View source

Derived from the flake8-bandit linter.

What it does

Check for method calls that initiate a subprocess without a shell.

Why is this bad?

Starting a subprocess without a shell can prevent attackers from executing arbitrary shell commands; however, it is still error-prone. Consider validating the input.

Known problems

Prone to false positives as it is difficult to determine whether the passed arguments have been validated (#4045).

Example

import subprocess

cmd = input("Enter a command: ").split()
subprocess.run(cmd)

References