Only allow commands as a list of strings

Author: jonathan343

packages/smithy-aws-core/src/smithy_aws_core/identity/process.py

@@ -2,7 +2,6 @@
 #  SPDX-License-Identifier: Apache-2.0
 import asyncio
 import json
-import shlex
 from dataclasses import dataclass
 from datetime import UTC, datetime
 
@@ -31,15 +30,12 @@ class ProcessCredentialsResolver(
 
     def __init__(
         self,
-        command: str | list[str],
+        command: list[str],
         config: ProcessCredentialsConfig | None = None,
     ):
-        normalized_command = (
-            shlex.split(command) if isinstance(command, str) else command
-        )
-        if not normalized_command:
-            raise ValueError("command must be a non-empty string or list")
-        self._command = list(normalized_command)
+        if not command:
+            raise ValueError("command must be a non-empty list")
+        self._command = list(command)
         self._config = config or ProcessCredentialsConfig()
         self._credentials = None
 

packages/smithy-aws-core/tests/unit/identity/test_process.py

@@ -34,9 +34,9 @@ def test_config_custom_values():
     assert config.timeout == 60
 
 
-@pytest.mark.parametrize("command", [[], "", None])
+@pytest.mark.parametrize("command", [[], None])
 def test_resolver_invalid_command(command: object):
-    with pytest.raises(ValueError, match="command must be a non-empty string or list"):
+    with pytest.raises((ValueError, TypeError)):
         ProcessCredentialsResolver(command)  # type: ignore[arg-type]
 
 
@@ -383,25 +383,3 @@ async def test_command_with_multiple_args():
         stdout=asyncio.subprocess.PIPE,
         stderr=asyncio.subprocess.PIPE,
     )
-
-
-@pytest.mark.asyncio
-async def test_string_command_with_multiple_args():
-    resp_body = json.dumps(DEFAULT_RESPONSE_DATA)
-    process = mock_subprocess(0, resp_body.encode("utf-8"))
-
-    with patch("asyncio.create_subprocess_exec", return_value=process) as mock_exec:
-        resolver = ProcessCredentialsResolver(
-            'aws-credential-helper --profile "test profile" --format json'
-        )
-        await resolver.get_identity(properties={})
-
-    mock_exec.assert_called_once_with(
-        "aws-credential-helper",
-        "--profile",
-        "test profile",
-        "--format",
-        "json",
-        stdout=asyncio.subprocess.PIPE,
-        stderr=asyncio.subprocess.PIPE,
-    )