This issue is part of a Codex global repository scan.
Problem:
dptb data --split copies user-controlled dataset paths through os.system(f"cp -r ...") without quoting.
Code reference:
https://github.com/deepmodeling/deeptb/blob/86c60c73996f0dd961c3138f2e88424382cb734e/dptb/entrypoints/data.py#L86-L98
Impact:
Dataset paths containing spaces fail. Paths containing shell metacharacters can execute unintended commands. The file already imports shutil, so this can use structured Python copy APIs instead of a shell.
Suggested fix:
Use shutil.copytree() or shutil.copy2() depending on whether each matched input is a directory or file, and avoid invoking a shell.
This issue is part of a Codex global repository scan.
Problem:
dptb data --splitcopies user-controlled dataset paths throughos.system(f"cp -r ...")without quoting.Code reference:
https://github.com/deepmodeling/deeptb/blob/86c60c73996f0dd961c3138f2e88424382cb734e/dptb/entrypoints/data.py#L86-L98
Impact:
Dataset paths containing spaces fail. Paths containing shell metacharacters can execute unintended commands. The file already imports
shutil, so this can use structured Python copy APIs instead of a shell.Suggested fix:
Use
shutil.copytree()orshutil.copy2()depending on whether each matched input is a directory or file, and avoid invoking a shell.