PyCQA / bandit

Bandit is a tool designed to find common security issues in Python code.
https://bandit.readthedocs.io
Apache License 2.0
6.5k stars 610 forks source link

Guard against empty call argument list #1146

Closed ericwb closed 5 months ago

ericwb commented 5 months ago

Although probably uncommon, it is possible to pass an empty list to one of subprocess functions. If this is done, the injection_shell plugin raises an IndexError while checking the contents of the list argument given.

The fix is to simply check for a non-empty list. Test case was also added.

Fixes: #1141