Scarfski/json
1
0
Fork 0
mirror of https://github.com/nlohmann/json.git synced 2026-10-01 14:35:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Mark compare.py's subprocess and download calls for Bandit

Browse Source 
The commands are argument lists the script builds itself, and the
downloads are pinned https URLs whose SHA-256 is checked.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>
This commit is contained in:
Niels Lohmann
2026-10-01 10:28:47 +02:00
parent 448a90909e
commit 057c86de8c
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
tests/benchmarks/json_view/compare.py
View File

@@ -30,7 +30,8 @@ import platform
import re
import shlex
import shutil
import subprocess
# runs only the compilers and benchmark binaries this script builds
import subprocess # nosec B404
import sys
import tarfile
import urllib.request
@@ -71,12 +72,14 @@ DEFAULT_CORPUS = [
def run(cmd, **kwargs):
print('+ ' + ' '.join(shlex.quote(c) for c in cmd), flush=True)
return subprocess.run(cmd, check=True, **kwargs)
# cmd is an argument list built by this script, never a shell string
return subprocess.run(cmd, check=True, **kwargs) # nosec B603
def output(cmd):
try:
return subprocess.run(cmd, check=True, capture_output=True, text=True).stdout.strip()
# cmd is an argument list built by this script, never a shell string
return subprocess.run(cmd, check=True, capture_output=True, text=True).stdout.strip() # nosec B603
except (OSError, subprocess.CalledProcessError):
return ''
@@ -150,7 +153,8 @@ def download_library(name, work):
os.makedirs(os.path.dirname(archive), exist_ok=True)
if not os.path.isfile(archive):
print(f'downloading {pin["url"]}', flush=True)
urllib.request.urlretrieve(pin['url'], archive)
# the URLs are the https constants in PINNED, and the SHA-256 is checked below
urllib.request.urlretrieve(pin['url'], archive) # nosec B310
with open(archive, 'rb') as f:
digest = hashlib.sha256(f.read()).hexdigest()
if digest != pin['sha256']:
@@ -160,7 +164,7 @@ def download_library(name, work):
with tarfile.open(archive) as t:
# (the 'data' filter rejects links and paths outside the target where Python has it)
kwargs = {'filter': 'data'} if hasattr(tarfile, 'data_filter') else {}
t.extractall(os.path.join(work, 'download'), **kwargs) # noqa: S202 (checked archive)
t.extractall(os.path.join(work, 'download'), **kwargs) # noqa: S202 (checked archive) # nosec B202
if name == 'yyjson':
return Library(name, [os.path.join(src, 'src')], [os.path.join(src, 'src', 'yyjson.c')], [], pin['version'])
if name == 'simdjson':