Skip to content

fix: replace unsafe os.system calls with Python stdlib in build script#404

Open
hobostay wants to merge 1 commit intobytedance:mainfrom
hobostay:fix/replace-os-system-with-stdlib
Open

fix: replace unsafe os.system calls with Python stdlib in build script#404
hobostay wants to merge 1 commit intobytedance:mainfrom
hobostay:fix/replace-os-system-with-stdlib

Conversation

@hobostay
Copy link
Copy Markdown

Summary

  • Replace os.system("rm -rf ...") and os.system("cp ...") calls in build_with_pyinstaller() with safer Python stdlib equivalents (shutil, os)

Problem

The build_with_pyinstaller() function uses os.system() to run shell commands like rm -rf, cp, and mkdir. This is problematic because:

  1. Security: os.system() spawns a shell, introducing potential injection vectors
  2. Cross-platform: rm and cp are Unix-only commands; they don't exist on Windows
  3. Error handling: os.system() only returns an exit code — no proper exceptions on failure

Fix

Replaced all os.system() calls with:

  • shutil.rmtree() instead of rm -rf
  • shutil.copy() instead of cp
  • shutil.copytree() instead of cp -r
  • os.makedirs() instead of mkdir

Test plan

  • Run build_with_pyinstaller() and verify the build output is identical
  • Verify it works on both Unix and Windows

🤖 Generated with Claude Code

Replace os.system("rm -rf ...") and os.system("cp ...") with safer
shutil and os module equivalents. This improves:
- Security: avoids shell injection vectors
- Cross-platform: works on Windows where rm/cp are unavailable
- Error handling: Python APIs raise proper exceptions on failure

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@CLAassistant
Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.


Test User seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants