Repository: PyCQA/bandit
Pull request #1144 (2024-06-10 11:13:25)

Bump docker/build-push-action from 5.3.0 to 5.4.0
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5.3.0 to 5.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/docker/build-push-action/releases">docker/build-push-action's releases</a>.</em></p>
<blockquote>
<h2>v5.4.0</h2>
<ul>
<li>Show builder information before building by <a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a href="https://redirect.github.com/docker/build-push-action/pull/1128">docker/build-push-action#1128</a></li>
<li>Handle attestations correctly with provenance and sbom inputs by <a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a href="https://redirect.github.com/docker/build-push-action/pull/1086">docker/build-push-action#1086</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.19.0 to 0.24.0 in <a href="https://redirect.github.com/docker/build-push-action/pull/1088">docker/build-push-action#1088</a> <a href="https://redirect.github.com/docker/build-push-action/pull/1105">docker/build-push-action#1105</a> <a href="https://redirect.github.com/docker/build-push-action/pull/1121">docker/build-push-action#1121</a> <a href="https://redirect.github.com/docker/build-push-action/pull/1127">docker/build-push-action#1127</a></li>
<li>Bump undici from 5.28.3 to 5.28.4 in <a href="https://redirect.github.com/docker/build-push-action/pull/1090">docker/build-push-action#1090</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/docker/build-push-action/compare/v5.3.0...v5.4.0">https://github.com/docker/build-push-action/compare/v5.3.0...v5.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/docker/build-push-action/commit/ca052bb54ab0790a636c9b5f226502c73d547a25"><code>ca052bb</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1128">#1128</a> from crazy-max/builder-info</li>
<li><a href="https://github.com/docker/build-push-action/commit/025c2051f357779d6be78f8fdffcc9ae0e345e3c"><code>025c205</code></a> chore: update generated content</li>
<li><a href="https://github.com/docker/build-push-action/commit/12076d2fb15a83ad948fcf164db081e9de7064fc"><code>12076d2</code></a> show builder information before building</li>
<li><a href="https://github.com/docker/build-push-action/commit/ef6cba335306ace1da064b44f9f739dec9be9fa0"><code>ef6cba3</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1127">#1127</a> from docker/dependabot/npm_and_yarn/docker/actions-t...</li>
<li><a href="https://github.com/docker/build-push-action/commit/4c16cf906a7af8d29be02479fdd3cb5408edd73a"><code>4c16cf9</code></a> chore: update generated content</li>
<li><a href="https://github.com/docker/build-push-action/commit/a3118a86c83324e3d04d83cb3ae321c9da2bda8c"><code>a3118a8</code></a> fixes since moved types</li>
<li><a href="https://github.com/docker/build-push-action/commit/c86eb8b0f72023f5434b46dbf82995f169cdd8e8"><code>c86eb8b</code></a> chore(deps): Bump <code>@​docker/actions-toolkit</code> from 0.23.0 to 0.24.0</li>
<li><a href="https://github.com/docker/build-push-action/commit/2a53c6ccda456d31fb62eedc658aae06e238b7bd"><code>2a53c6c</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1122">#1122</a> from crazy-max/update-dev-deps</li>
<li><a href="https://github.com/docker/build-push-action/commit/ccef1f210db2126b52900f94dd47ba79cdace531"><code>ccef1f2</code></a> chore: update generated content</li>
<li><a href="https://github.com/docker/build-push-action/commit/79117b6ea56ef284639bbbeeb8a2d4ddb7d97c37"><code>79117b6</code></a> chore: update dev dependencies</li>
<li>Additional commits viewable in <a href="https://github.com/docker/build-push-action/compare/2cdde995de11925a030ce8070c3d77a52ffcf1c0...ca052bb54ab0790a636c9b5f226502c73d547a25">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/build-push-action&package-manager=github_actions&previous-version=5.3.0&new-version=5.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/.github/workflows/build-publish-image.yml b/.github/workflows/build-publish-image.yml
index 34463fa..f69c162 100644
--- a/.github/workflows/build-publish-image.yml
+++ b/.github/workflows/build-publish-image.yml
@@ -51,7 +51,7 @@ jobs:
 
     - name: Build and push Docker image
       id: build-and-push
-      uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5
+      uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
       with:
         context: .
         file: ./docker/Dockerfile
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 9838e02..8ecd3b9 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -18,7 +18,7 @@ repos:
   - id: black
     args: [--line-length=79, --target-version=py38]
 - repo: https://github.com/asottile/pyupgrade
-  rev: v3.15.2
+  rev: v3.16.0
   hooks:
   - id: pyupgrade
     args: [--py38-plus]
diff --git a/bandit/plugins/injection_shell.py b/bandit/plugins/injection_shell.py
index 5bd9c96..2293683 100644
--- a/bandit/plugins/injection_shell.py
+++ b/bandit/plugins/injection_shell.py
@@ -683,7 +683,7 @@ def start_process_with_partial_path(context, config):
         ):
             node = context.node.args[0]
             # some calls take an arg list, check the first part
-            if isinstance(node, ast.List):
+            if isinstance(node, ast.List) and node.elts:
                 node = node.elts[0]
 
             # make sure the param is a string literal and not a var name
diff --git a/examples/subprocess_shell.py b/examples/subprocess_shell.py
index d8076d5..38944d5 100644
--- a/examples/subprocess_shell.py
+++ b/examples/subprocess_shell.py
@@ -25,6 +25,7 @@ subprocess.check_call('/bin/ls -l', shell=True)
 
 subprocess.check_output(['/bin/ls', '-l'])
 subprocess.check_output('/bin/ls -l', shell=True)
+subprocess.check_output([], stdout=None)
 
 subprocess.getoutput('/bin/ls -l')
 subprocess.getstatusoutput('/bin/ls -l')


Test patch:
diff --git a/tests/functional/test_functional.py b/tests/functional/test_functional.py
index 85db6ab..fd96796 100644
--- a/tests/functional/test_functional.py
+++ b/tests/functional/test_functional.py
@@ -492,8 +492,8 @@ class FunctionalTests(testtools.TestCase):
     def test_subprocess_shell(self):
         """Test for `subprocess.Popen` with `shell=True`."""
         expect = {
-            "SEVERITY": {"UNDEFINED": 0, "LOW": 23, "MEDIUM": 1, "HIGH": 11},
-            "CONFIDENCE": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 0, "HIGH": 34},
+            "SEVERITY": {"UNDEFINED": 0, "LOW": 24, "MEDIUM": 1, "HIGH": 11},
+            "CONFIDENCE": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 0, "HIGH": 35},
         }
         self.check_example("subprocess_shell.py", expect)