CVE-2024-29189: Insufficient Information (NVD-CWE-noinfo)
value: PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_instance.py, upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-26T03:15Z
Repository: https://github.com/ansys/pyansys-geometry
Language: Python
Files changed: doc/changelog.d/1077.added.md, src/ansys/geometry/core/connection/product_instance.py
Commit date: 2024-03-22 08:32:20 +0100
Commit message: feat: accept bandit advisories in-line for subprocess (#1077)

Co-authored-by: pyansys-ci-bot <pyansys.github.bot@ansys.com>
Diff: diff --git a/doc/changelog.d/1077.added.md b/doc/changelog.d/1077.added.md
new file mode 100644
index 0000000..c706cd4
--- /dev/null
+++ b/doc/changelog.d/1077.added.md
@@ -0,0 +1 @@
+feat: accept bandit advisories in-line for subprocess
\ No newline at end of file
diff --git a/src/ansys/geometry/core/connection/product_instance.py b/src/ansys/geometry/core/connection/product_instance.py
index 1158ede..1f01735 100644
--- a/src/ansys/geometry/core/connection/product_instance.py
+++ b/src/ansys/geometry/core/connection/product_instance.py
@@ -21,11 +21,14 @@
 # SOFTWARE.
 """Module containing the ``ProductInstance`` class."""
 import os
 import signal
 import socket
-import subprocess
+
+# Subprocess is needed to start the backend. But
+# the input is controlled by the library. Excluding bandit check.
+import subprocess  # nosec B404
 
 from ansys.tools.path import get_available_ansys_installations, get_latest_ansys_installation
 from beartype.typing import TYPE_CHECKING, Dict, List
 
 from ansys.geometry.core.connection.backend import ApiVersions, BackendType
@@ -300,11 +303,11 @@ def prepare_and_start_backend(
 
     LOG.info(f"Launching ProductInstance for {backend_type.name}")
     LOG.debug(f"Args: {args}")
     LOG.debug(f"Environment variables: {env_copy}")
 
-    instance = ProductInstance(_start_program(args, env_copy).pid)
+    instance = ProductInstance(__start_program(args, env_copy).pid)
 
     # Verify that the backend is ready to accept connections
     # before returning the Modeler instance.
     LOG.info("Waiting for backend to be ready...")
     _wait_for_backend(host, port, timeout)
@@ -401,11 +404,11 @@ def _manifest_path_provider(
         )
         LOG.error(msg)
         raise RuntimeError(msg)
 
 
-def _start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Popen:
+def __start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Popen:
     """
     Start the program where the path is the first item of the ``args`` array argument.
 
     Parameters
     ----------
@@ -418,11 +421,12 @@ def _start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Pop
     Returns
     -------
     subprocess.Popen
         The subprocess object.
     """
-    return subprocess.Popen(
+    # private method and controlled input by library - excluding bandit check.
+    return subprocess.Popen(  # nosec B603
         args,
         stdin=subprocess.DEVNULL,
         stdout=subprocess.DEVNULL,
         stderr=subprocess.DEVNULL,
         env=local_env,

Vulnerable code: import subprocess
    instance = ProductInstance(_start_program(args, env_copy).pid)
def _start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Popen:
    return subprocess.Popen(
Fixed code: feat: accept bandit advisories in-line for subprocess

# Subprocess is needed to start the backend. But
# the input is controlled by the library. Excluding bandit check.
import subprocess  # nosec B404
    instance = ProductInstance(__start_program(args, env_copy).pid)
def __start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Popen:
    # private method and controlled input by library - excluding bandit check.
    return subprocess.Popen(  # nosec B603