fix: explicitly set shell=False to prevent command injection

AK47Kavan · AK47Kavan · commit bf6f68f84ef5 · 2026-07-12T20:34:37.000+05:30
diff --git a/python/agents/plumber-data-engineering-assistant/plumber_agent/sub_agents/monitoring_agent/tools/dataproc.py b/python/agents/plumber-data-engineering-assistant/plumber_agent/sub_agents/monitoring_agent/tools/dataproc.py
@@ -257,7 +257,7 @@ def get_dataproc_normal_job_logs_with_id(
     try:
         # Execute the command and capture the output.
         result = subprocess.run(
-            command_str, capture_output=True, text=True, check=False, shell=True
+            command_str, capture_output=True, text=True, check=False, shell=False
         )
         logger.info(
             "Result for '%s' command: returncode=%s",

Original file line number	Diff line number	Diff line change
`@@ -257,7 +257,7 @@ def get_dataproc_normal_job_logs_with_id(`
`257`	`257`	`try:`
`258`	`258`	`# Execute the command and capture the output.`
`259`	`259`	`result = subprocess.run(`
`260`		`- command_str, capture_output=True, text=True, check=False, shell=True`
	`260`	`+ command_str, capture_output=True, text=True, check=False, shell=False`
`261`	`261`	`)`
`262`	`262`	`logger.info(`
`263`	`263`	`"Result for '%s' command: returncode=%s",`