Merge pull request #3307 from Ali-Razmjoo/fix-shell-command

Fix unsafe shell command in luigi/contrib/lsf.py
spotify · Sep 5, 2024 · c9a0d20 · c9a0d20
2 parents 38dbd88 + 31e5c9f
commit c9a0d20
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/luigi/contrib/lsf.py b/luigi/contrib/lsf.py
@@ -81,9 +81,9 @@ def track_job(job_id):
     - "EXIT"
     based on the LSF documentation
     """
-    cmd = "bjobs -noheader -o stat {}".format(job_id)
+    cmd = ["bjobs", "-noheader", "-o", "stat", str(job_id)]
     track_job_proc = subprocess.Popen(
-        cmd, stdout=subprocess.PIPE, shell=True)
+        cmd, stdout=subprocess.PIPE, shell=False)
     status = track_job_proc.communicate()[0].strip('\n')
     return status