Refactor subprocess argument construction in start_dashboard and test_end_to_end for enhanced security; use explicit lists to prevent injection vulnerabilities

Author: rbeucher

src/access_mopper/batch_cmoriser.py

@@ -42,10 +42,12 @@ def start_dashboard(dashboard_path: str, db_path: str):
     dashboard_arg = escaped_dashboard_path  # Validated and escaped dashboard path
 
     # Use explicit argument assignment to satisfy security scanners
-    # Security: Create explicit list to satisfy static string requirement
-    subprocess_args = [STREAMLIT_EXECUTABLE, RUN_COMMAND, dashboard_arg]
     subprocess.Popen(  # noqa: S603  # nosec B603
-        subprocess_args,  # Explicit list variable with predefined elements
+        [
+            STREAMLIT_EXECUTABLE,
+            RUN_COMMAND,
+            dashboard_arg,
+        ],  # Explicit list with predefined elements
         env=env,
         stdout=subprocess.DEVNULL,
         stderr=subprocess.DEVNULL,

tests/e2e/test_end_to_end.py

@@ -125,16 +125,15 @@ def test_prepare_validation(self, parent_experiment_config):
                 output_arg = escaped_output_file  # Validated and escaped output file
 
                 # Use explicit argument assignment to satisfy security scanners
-                cmd_args = [
-                    PREPARE_EXECUTABLE,
-                    VARIABLE_FLAG,
-                    VARIABLE_VALUE,
-                    TABLE_PATH_FLAG,
-                    table_arg,
-                    output_arg,
-                ]
                 result = subprocess.run(  # noqa: S603  # nosec B603
-                    cmd_args,  # Explicit list variable with predefined elements
+                    [
+                        PREPARE_EXECUTABLE,
+                        VARIABLE_FLAG,
+                        VARIABLE_VALUE,
+                        TABLE_PATH_FLAG,
+                        table_arg,
+                        output_arg,
+                    ],  # Explicit list with predefined elements
                     capture_output=True,
                     text=True,
                     check=False,