test(ci): пробник HIGH-находки для bandit (B602), lint-чистый — Refs #17
ci / lint (push) Successful in 51s
contract-openapi / openapi-contract (push) Failing after 31s
contract-openapi / ts-client-is-current (push) Failing after 36s
ci / unit (push) Failing after 52s
ci / security (push) Failing after 4m26s
ci / build (push) Has been skipped
ci / image-scan (push) Has been skipped
ci / push (push) Has been skipped
ci / lint (push) Successful in 51s
contract-openapi / openapi-contract (push) Failing after 31s
contract-openapi / ts-client-is-current (push) Failing after 36s
ci / unit (push) Failing after 52s
ci / security (push) Failing after 4m26s
ci / build (push) Has been skipped
ci / image-scan (push) Has been skipped
ci / push (push) Has been skipped
This commit is contained in:
@@ -1,15 +1,15 @@
|
|||||||
"""CI-пробник для негативного прогона гейта security (bandit).
|
"""CI probe: intentionally insecure module for the negative security-gate run.
|
||||||
|
|
||||||
Содержит намеренно небезопасный вызов `subprocess.call(..., shell=True)` —
|
Lives only on the ``ci/17-gate-negative`` branch (deleted together with it);
|
||||||
bandit B602, severity HIGH. Файл живёт только в ветке `ci/17-gate-negative`
|
it is not present in ``main`` or ``feat/*``.
|
||||||
и удаляется вместе с ней; в `main`/`feat/*` его нет.
|
|
||||||
|
Contains a deliberately unsafe ``subprocess.call(..., shell=True)`` call —
|
||||||
|
bandit B602, severity HIGH.
|
||||||
"""
|
"""
|
||||||
|
|
||||||
from __future__ import annotations
|
|
||||||
|
|
||||||
import subprocess
|
import subprocess
|
||||||
|
|
||||||
|
|
||||||
def run_probe(cmd: str) -> int:
|
def run_probe(cmd: str) -> int:
|
||||||
"""Намеренно небезопасно: shell=True (bandit B602 -> HIGH)."""
|
"""Deliberately unsafe: shell=True (bandit B602 -> HIGH)."""
|
||||||
return subprocess.call(cmd, shell=True) # noqa: S602
|
return subprocess.call(cmd, shell=True) # noqa: S602
|
||||||
|
|||||||
Reference in New Issue
Block a user