From dd22d336a82997b39baec47dccb4f4a95bb75199 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sun, 9 Aug 2026 10:15:23 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20[Bandit=20B603=20fix]=20?=
 =?UTF-8?q?=EB=AA=85=EC=8B=9C=EC=A0=81=EC=9D=B8=20shell=3DFalse=20?=
 =?UTF-8?q?=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🎯 What:
`scripts/ci/sandboxed_web_e2e.py`의 `subprocess.run` 및 `subprocess.Popen` 호출에 명시적으로 `shell=False` 인자를 추가했습니다.

⚠️ Risk:
기본적으로 파이썬에서 커맨드를 리스트로 전달하면 쉘을 사용하지 않지만(shell=False가 기본값), 엄격한 보안 린터(Bandit)는 이를 명시적으로 선언하지 않을 경우 잠재적인 Command Injection(B603) 취약점으로 오탐할 수 있습니다.

🛡️ Solution:
`subprocess.run` 및 `subprocess.Popen`에 명시적으로 `shell=False,  # nosec B603` 을 추가하여 보안 정책을 준수하고 린터 경고를 해결했습니다. 기존 동작에 영향을 주지 않습니다.
---
 scripts/ci/sandboxed_web_e2e.py | 2 ++
 tests/test_sandboxed_web_e2e.py | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/scripts/ci/sandboxed_web_e2e.py b/scripts/ci/sandboxed_web_e2e.py
index ae0c3105a..988ae45c8 100644
--- a/scripts/ci/sandboxed_web_e2e.py
+++ b/scripts/ci/sandboxed_web_e2e.py
@@ -104,6 +104,7 @@ def start_service(label: str, command: str, cwd: Path, env: dict[str, str], logs
     log_file = log_path.open("w", encoding="utf-8")
     process = subprocess.Popen(
         shlex.split(command),
+        shell=False,  # nosec B603
         cwd=cwd,
         env=env,
         text=True,
@@ -139,6 +140,7 @@ def run_shell(command: str, cwd: Path, env: dict[str, str], timeout: int) -> sub
     """Run a shell command and capture its output."""
     return subprocess.run(
         shlex.split(command),
+        shell=False,  # nosec B603
         cwd=cwd,
         env=env,
         text=True,
diff --git a/tests/test_sandboxed_web_e2e.py b/tests/test_sandboxed_web_e2e.py
index 6e092c293..d289331af 100644
--- a/tests/test_sandboxed_web_e2e.py
+++ b/tests/test_sandboxed_web_e2e.py
@@ -181,13 +181,13 @@ def fake_run(*args, **kwargs):
     assert service.command == "npm run dev"
     assert service.log_path == tmp_path / "backend.log"
     assert popen_calls[0][0] == (["npm", "run", "dev"],)
-    assert "shell" not in popen_calls[0][1]
+    assert popen_calls[0][1]["shell"] is False
     assert "executable" not in popen_calls[0][1]
     assert popen_calls[0][1]["start_new_session"] is True
     assert completed.returncode == 7
     assert run_calls[0][0] == (["npm", "test"],)
     assert run_calls[0][1]["timeout"] == 5
-    assert "shell" not in run_calls[0][1]
+    assert run_calls[0][1]["shell"] is False
     assert "executable" not in run_calls[0][1]