Use of import-from means shell=True goes undetected.

[stephenpaulger]

shell=True is not flagged as problematic when the function is imported with from subprocess import.

Two functionally equivalent python files, I would expect equivalent results.

# shell_true_import_from.py
from subprocess import call

call("echo hello", shell=True)

# shell_true_import_subprocess.py
import subprocess

subprocess.call("echo hello", shell=True)

Unfortunately, only one file is detected as problematic.

% flake8
./shell_true_import_subprocess.py:3:1: SCS103 use of `shell=True` in subprocess functions or use of functions that internally set it should be avoided

[Takishima]

Hi,
Sorry for my late reply.

After a quick thought, fixing the failing case will be trickier than expected since this tool is only parsing the AST without actually executing the Python code. One way of doing things would be to keep track of all functions names that appear in an import clause and then at each function call match against those. This is probably doable but will require some care when designing the code so that we catch all possible ways of importing a function (ie. from X import Y, import X as Z; from Z import Y, etc.)

A quick example to illustrate some other possible difficulty:

from subprocess import call

# Now `call` refers to the function from the subprocess module

def my_call(msg, shell):
    # ... do something

call = my_call

# Now `call` actually refers to my custom function which this tool has no way of knowing anything about

call('echo hello', shell=True) # error reported here, although this is not subprocess.call

In short, I will try to look into this but fixing this issue will take some time.