B603 false positive?

Describe the bug I don’t understand how I should "check for untrusted input.

To Reproduce Steps to reproduce the behavior:

With the code:

import shlex
import subprocess

def foo():
    args = shlex.split("git rev-parse HEAD")
    return str(subprocess.check_output(args, shell=False), "utf-8").strip()

Gives Issue: [B603:subprocess_without_shell_equals_true] subprocess call - check for execution of untrusted input. I don’t understand how this is shell equals true given that “shell=False” is passed, nor how this is untrusted input.

Expected behavior

This line shouldn’t be flagged as a warning

Bandit version

bandit --version
bandit 1.4.0

Additional context

[pzelnip]

I see your point, but I suppose I’m having trouble how you could possibly use subprocess.check_output without triggering B603. Ie I get that all it sees is args and it has no idea if args is trusted or not, but even if I put the string literal into the call:

return str(
        subprocess.check_output("git rev-parse HEAD".split(), shell=False), "utf-8"
    ).strip()

I still trigger B603. As such this feels more like “don’t use subprocess.check_output” rather than “make sure the input to subprocess.check_output is trusted”, so it feels like the description of B603 is misleading/not helpful. Or am I missing a way to use subprocess.check_output without triggering B603?

[bcaller]

Actually you’re right. My apologies. I checked the code and the test is a bit dumb. It will flag any use of check_output regardless. The example in the test’s docstring is subprocess.check_output(['/bin/ls', '-l']) which I wouldn’t consider vulnerable to injection.

I agree with you that the test should be improved to decrease obvious false positives.