From f65e9ecfda4e22d4a0242a404455bd0a4e4831de Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sun, 23 Aug 2026 14:06:05 +0000
Subject: [PATCH 1/2] =?UTF-8?q?=EB=B3=B4=EC=95=88=20=ED=96=A5=EC=83=81:=20?=
 =?UTF-8?q?sandboxed=5Fweb=5Fe2e.py=20=EB=82=B4=20subprocess=20=ED=98=B8?=
 =?UTF-8?q?=EC=B6=9C=EC=97=90=20shell=3DFalse=20=EB=AA=85=EC=8B=9C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`sandboxed_web_e2e.py`의 `subprocess.Popen`과 `subprocess.run` 호출 시 기본적으로 쉘 없이 실행됨에도 불구하고, Bandit B603과 같은 보안 린터 경고를 해결하고 명시적인 보안성을 보장하기 위해 `shell=False` 인자를 추가했습니다. 또한, 해당 사항을 반영하여 관련 테스트 코드(`tests/test_sandboxed_web_e2e.py`)의 모의 객체 검증(assertion)을 수정했습니다.
---
 scripts/ci/sandboxed_web_e2e.py | 2 ++
 tests/test_sandboxed_web_e2e.py | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/scripts/ci/sandboxed_web_e2e.py b/scripts/ci/sandboxed_web_e2e.py
index ae0c3105a..49b6c5f42 100644
--- a/scripts/ci/sandboxed_web_e2e.py
+++ b/scripts/ci/sandboxed_web_e2e.py
@@ -110,6 +110,7 @@ def start_service(label: str, command: str, cwd: Path, env: dict[str, str], logs
         stdout=log_file,
         stderr=subprocess.STDOUT,
         start_new_session=True,
+        shell=False,  # nosec B603
     )
     log_file.close()
     return Service(label=label, command=command, process=process, log_path=log_path)
@@ -146,6 +147,7 @@ def run_shell(command: str, cwd: Path, env: dict[str, str], timeout: int) -> sub
         stderr=subprocess.PIPE,
         timeout=timeout,
         check=False,
+        shell=False,  # nosec B603
     )
 
 
diff --git a/tests/test_sandboxed_web_e2e.py b/tests/test_sandboxed_web_e2e.py
index 6e092c293..a51051f27 100644
--- a/tests/test_sandboxed_web_e2e.py
+++ b/tests/test_sandboxed_web_e2e.py
@@ -181,13 +181,13 @@ def fake_run(*args, **kwargs):
     assert service.command == "npm run dev"
     assert service.log_path == tmp_path / "backend.log"
     assert popen_calls[0][0] == (["npm", "run", "dev"],)
-    assert "shell" not in popen_calls[0][1]
+    assert popen_calls[0][1].get("shell") is False
     assert "executable" not in popen_calls[0][1]
     assert popen_calls[0][1]["start_new_session"] is True
     assert completed.returncode == 7
     assert run_calls[0][0] == (["npm", "test"],)
     assert run_calls[0][1]["timeout"] == 5
-    assert "shell" not in run_calls[0][1]
+    assert run_calls[0][1].get("shell") is False
     assert "executable" not in run_calls[0][1]
 
 

From 881a5a94123469097fa56f3d74638b9f9fb4a7fe Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sun, 23 Aug 2026 14:11:23 +0000
Subject: [PATCH 2/2] =?UTF-8?q?=EB=B3=B4=EC=95=88=20=ED=96=A5=EC=83=81:=20?=
 =?UTF-8?q?sandboxed=5Fweb=5Fe2e.py=20=EB=82=B4=20subprocess=20=ED=98=B8?=
 =?UTF-8?q?=EC=B6=9C=EC=97=90=20shell=3DFalse=20=EB=AA=85=EC=8B=9C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`sandboxed_web_e2e.py`의 `subprocess.Popen`과 `subprocess.run` 호출 시 기본적으로 쉘 없이 실행됨에도 불구하고, Bandit B603과 같은 보안 린터 경고를 해결하고 명시적인 보안성을 보장하기 위해 `shell=False` 인자를 추가했습니다. 또한, 해당 사항을 반영하여 관련 테스트 코드(`tests/test_sandboxed_web_e2e.py`)의 모의 객체 검증(assertion)을 수정했습니다.