[flake8-bandit] Check tuple arguments for partial paths in S607

crates/ruff_linter/resources/test/fixtures/flake8_bandit/S607.py

@@ -42,3 +42,8 @@
 os.system(["/bin/ls"])
 os.system(["/bin/ls", "/tmp"])
 os.system(r"C:\\bin\ls")
+
+# Regression for https://github.com/astral-sh/ruff/issues/24075
+# Check that "partial path" checks tuples too
+import subprocess
+subprocess.run(("echo", "foo"))

crates/ruff_linter/src/rules/flake8_bandit/rules/shell_injection.rs

@@ -515,7 +515,9 @@ fn is_full_path(text: &str) -> bool {
 /// partial path.
 fn is_partial_path(expr: &Expr) -> bool {
     let string_literal = match expr {
-        Expr::List(ast::ExprList { elts, .. }) => elts.first().and_then(string_literal),
+        Expr::List(ast::ExprList { elts, .. }) | Expr::Tuple(ast::ExprTuple { elts, .. }) => {
+            elts.first().and_then(string_literal)
+        }
         _ => string_literal(expr),
     };
     string_literal.is_some_and(|text| !is_full_path(text))

crates/ruff_linter/src/rules/flake8_bandit/snapshots/ruff_linter__rules__flake8_bandit__tests__S607_S607.py.snap

@@ -241,3 +241,12 @@ S607 Starting a process with a partial executable path
 38 |
 39 | # Check it does not fail for full paths.
    |
+
+S607 Starting a process with a partial executable path
+  --> S607.py:49:16
+   |
+47 | # Check that "partial path" checks tuples too
+48 | import subprocess
+49 | subprocess.run(("echo", "foo"))
+   |                ^^^^^^^^^^^^^^^
+   |