security: repair scanning and close stale alert sources

2026-08-03 19:21:42 +00:00 · 2026-08-02 15:22:13 -04:00
parent 42492e14a5
commit 5780c239e4
48 changed files with 427 additions and 325 deletions
@@ -317,7 +317,9 @@ def generate_nvs_binary(csv_content: str, size: int) -> bytes:
            "nvs_partition_generator", "nvs_partition_gen.py"
        )
        if os.path.isfile(gen_script):
-            subprocess.check_call([
+            # Fixed interpreter/script plus an argv list (never a shell);
+            # csv_path/bin_path are private NamedTemporaryFile paths.
+            subprocess.check_call([  # nosemgrep: dangerous-subprocess-use-tainted-env-args
                sys.executable, gen_script, "generate",
                csv_path, bin_path, hex(size)
            ])