FrancescoCastaldi commented on PR #39724:
URL: https://github.com/apache/superset/pull/39724#issuecomment-5621591929
Thanks for the thorough review and security catch @sadpandajoe!
I've addressed both points in commit ff19f5492c2:
1. **Windows shell & command injection prevention**:
- Switched to `shell=False` across all platforms (`_SHELL = False`);
commands now execute directly via `subprocess.run` without running through a
shell interpreter (`cmd.exe`).
- Updated `find_node_bin` to resolve `.cmd` first on Windows so wrappers
are invoked directly.
- Added `_quote_cmd_arg()` to defensively quote arguments containing cmd
metacharacters (`&`, `|`, `<`, `>`, `^`, `%`, `"`) on Windows.
- Updated `test_run_command_shell_flag` to verify `shell=False` and added
`test_run_command_quotes_cmd_metacharacters`.
2. **oxfmt formatting of generated JSON**:
- Replaced `--no-error-on-unmatched-pattern` with `--no-ignore` so
`oxfmt` actively formats the gitignored `messages.json` files.
- Updated the unit test assertions in `compile_po_test.py` to verify that
`--no-ignore` is passed.
All 21 unit tests and ruff linting pass cleanly!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
