Skip to content

Avoid shell=True in subprocess calls and re-validate project field - #403

Open
arash77 wants to merge 1 commit into
ERGA-consortium:mainfrom
arash77:fix/subprocess-shell-injection
Open

Avoid shell=True in subprocess calls and re-validate project field#403
arash77 wants to merge 1 commit into
ERGA-consortium:mainfrom
arash77:fix/subprocess-shell-injection

Conversation

@arash77

@arash77 arash77 commented Aug 11, 2026

Copy link
Copy Markdown
Collaborator

Replace shell=True with an argv list in the two subprocess.run calls. The values passed in come from the PR body and from the changed file list, so a shell should not parse them. Both calls now use sys.executable instead of a bare python, which is not always on PATH.

Also re-validate the Project field from the PR body in find_reviewer. find_supervisor already does this check, but find_reviewer reads the body again on a later run and had no check of its own. The new check raises inside the existing try block, so an invalid project gets the usual error path with the supervisor notified and the ERROR! label.

On a runner without python on PATH the old code failed quietly and the bot posted an empty code block instead of the reviewer table, since the return code was never checked. Using sys.executable fixes that as well.

Reviewer selection is unchanged. Same inputs give the same reviewer before and after.

The two subprocess.run() calls in the bot built their command as a
formatted string with shell=True, interpolating values that originate
from PR-controlled input:

- get_reviewer() interpolated `institution` and `project`, both read
  from the PR body, into a single-quoted shell string.
- _add_yaml_file() interpolated the EAR PDF filename, which comes from
  the PR's changed-file list.

Both now pass an argv list, so the values are handed to the child
process as literal arguments and can no longer be interpreted by a
shell. They also use sys.executable rather than a bare `python`, which
is not guaranteed to be on PATH.

Additionally, find_reviewer() now re-validates the Project field from
the PR body against valid_projects before using it. find_supervisor()
already did this, but find_reviewer() re-read the body independently
and had no equivalent check, so a body edited after the initial
validation was used unchecked. The check raises inside the existing
try block, so an invalid project follows the established error path
(supervisor notified, ERROR! label applied).

No change to reviewer selection behaviour.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Replaces unsafe shell-based subprocess calls and validates the PR project before reviewer selection.

Changes:

  • Uses argv lists with sys.executable for subprocesses.
  • Rejects invalid projects in find_reviewer.
  • Preserves existing reviewer-selection behavior.

馃挕 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants