cleveragents/cleveragents-core
4
0
Fork 3
Code Issues 6.0k Pull Requests 115 Actions Packages Projects Releases Wiki Activity

fix(test): replace shell=True with shell=False in cli_coverage_steps.py subprocess call #1071

Merged
CoreRasurae merged 1 commits from fix/m3-shell-true-subprocess into master 2026-03-23 23:21:30 +00:00
Conversation 2 Commits 1 Files Changed 2
+6 -2
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+4
View File
@@ -2,6 +2,10 @@
## Unreleased
- Fixed `shell=True` subprocess usage in `cli_coverage_steps.py` by replacing
with `shlex.split()` and `shell=False` for defense-in-depth command injection
prevention, consistent with the existing pattern in
`cli_plan_context_commands_steps.py`. (#734)
- Added BuiltinAdapter class and MCP automatic resource slot creation.
BuiltinAdapter wraps register_file_tools/register_git_tools/register_subplan_tool
into a unified adapter interface. McpAdapter.infer_resource_slots() analyzes
features/steps/cli_coverage_steps.py
+2 -2
View File
@@ -1,5 +1,6 @@
"""Step definitions for CLI coverage tests."""
import shlex
CoreRasurae commented 2026-03-23 22:14:17 +00:00
Outdated
Review
Copy Link
Copy Source

[Low -- Bug] This docstring is now misleading. The function no longer uses a subprocess shell (shell=True was removed). Consider updating to:

"""Run a CLI command as a subprocess."""
**[Low -- Bug]** This docstring is now misleading. The function no longer uses a subprocess shell (`shell=True` was removed). Consider updating to: ```python """Run a CLI command as a subprocess.""" ```
import subprocess
import sys
from contextlib import redirect_stdout
1
 @@ -39,9 +40,8 @@ def step_run_shell_command(context, command):
else:
command = python_cmd + command[len("cleveragents") :]
# Use shell=True to handle quoted arguments correctly
result = subprocess.run(
command, capture_output=True, text=True, timeout=120, cwd=cwd, shell=True
shlex.split(command), capture_output=True, text=True, timeout=120, cwd=cwd
)
context.exit_code = result.returncode
context.output = result.stdout + result.stderr