security: repair scanning and close stale alert sources

2026-08-03 19:21:42 +00:00 · 2026-08-02 15:22:13 -04:00
parent 42492e14a5
commit 5780c239e4
48 changed files with 427 additions and 325 deletions
@@ -103,7 +103,9 @@ def generate_nvs_binary(csv_content, size):
        gen_script = os.path.join(idf_path, "components", "nvs_flash",
                                  "nvs_partition_generator", "nvs_partition_gen.py")
        if os.path.isfile(gen_script):
-            subprocess.check_call([
+            # Fixed interpreter/script plus an argv list (never a shell);
+            # csv_path/bin_path are private NamedTemporaryFile paths.
+            subprocess.check_call([  # nosemgrep: dangerous-subprocess-use-tainted-env-args
                sys.executable, gen_script, "generate",
                csv_path, bin_path, hex(size)
            ])