Skip to content

[Code scan] Replace shell-based dataset split copies with shutil calls #359

Description

@njzjz

This issue is part of a Codex global repository scan.

Problem:
dptb data --split copies user-controlled dataset paths through os.system(f"cp -r ...") without quoting.

Code reference:
https://github.com/deepmodeling/deeptb/blob/86c60c73996f0dd961c3138f2e88424382cb734e/dptb/entrypoints/data.py#L86-L98

Impact:
Dataset paths containing spaces fail. Paths containing shell metacharacters can execute unintended commands. The file already imports shutil, so this can use structured Python copy APIs instead of a shell.

Suggested fix:
Use shutil.copytree() or shutil.copy2() depending on whether each matched input is a directory or file, and avoid invoking a shell.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    Status
    Todo

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions