Skip to content

unix-command-wildcard-injection (S609)

Derived from the flake8-bandit linter.

What it does

Checks for possible wildcard injections in calls to subprocess.Popen().

Why is this bad?

Wildcard injections can lead to unexpected behavior if unintended files are matched by the wildcard. Consider using a more specific path instead.

Example

import subprocess

subprocess.Popen(["chmod", "777", "*.py"])

Use instead:

import subprocess

subprocess.Popen(["chmod", "777", "main.py"])

References