Skip to content

security updates #207

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
alexey-kireev wants to merge 1 commit into from
+16 −6
Closed

security updates #207

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 16 additions & 6 deletions python/setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
from setuptools import setup, Extension
from setuptools.command.build_ext import build_ext
from subprocess import run # pylint: disable=C0411
from shutil import which


def get_environment_flag(name):
Expand All @@ -27,10 +28,14 @@
itt_dir = os.environ.get('ITTAPI_ITT_API_SOURCE_DIR', None)
itt_dir = itt_dir if itt_dir else ITT_DEFAULT_DIR

assert os.path.exists(itt_dir), 'The specified directory with ITT API source code does not exist.'
assert itt_dir != ITT_DEFAULT_DIR or len(os.listdir(itt_dir)), \
(f'The specified directory with ITT API source code ({itt_dir}) is empty.\n'
f'Please make sure you provide a valid path.')
if not os.path.exists(itt_dir):
raise FileNotFoundError('The specified directory with ITT API source code does not exist.')

if itt_dir == ITT_DEFAULT_DIR and not len(os.listdir(itt_dir)):
Copy link

Copilot AI Jan 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The not len(os.listdir(itt_dir)) pattern is unnecessarily verbose. Use the more idiomatic not os.listdir(itt_dir) which directly evaluates the truthiness of the list.

Suggested change
if itt_dir == ITT_DEFAULT_DIR and not len(os.listdir(itt_dir)):
if itt_dir == ITT_DEFAULT_DIR and not os.listdir(itt_dir):

Copilot uses AI. Check for mistakes.
raise ValueError(
f'The specified directory with ITT API source code ({itt_dir}) is empty.\n'
f'Please make sure you provide a valid path.'
)

# Check if IPT support is requested
build_itt_with_ipt_support = get_environment_flag('ITTAPI_BUILD_WITH_ITT_API_IPT_SUPPORT')
Expand Down Expand Up @@ -98,6 +103,11 @@

as_path = os.path.dirname(self.compiler.cc) if hasattr(self.compiler, 'cc') else ''

# Validate assembler tool path (avoid untrusted execution)
as_full_path = os.path.join(as_path, as_tool) if as_path else which(as_tool)
if not as_full_path or not os.path.isfile(as_full_path):
raise RuntimeError(f"Assembler tool not found: {as_tool}")

# Extract asm files from extra objects
# pylint: disable=W0106
asm_files = [filename for filename in ext.extra_objects if filename.lower().endswith(as_ext)]
Expand All @@ -112,8 +122,8 @@
obj_asm_pairs = [(os.path.join(self.build_temp, os.path.splitext(filename)[0]) + '.obj',
os.path.join(src_dir, filename)) for filename in asm_files]
# Compile
[run([os.path.join(as_path, as_tool), '/Fo', obj_file, '/c', asm_file], check=True)
for obj_file, asm_file in obj_asm_pairs]
for obj_file, asm_file in obj_asm_pairs:
run([as_full_path, '/Fo', obj_file, '/c', asm_file], check=True, shell=False)

Check notice

Code scanning / Bandit

subprocess call - check for execution of untrusted input. Note

subprocess call - check for execution of untrusted input.

[ext.extra_objects.append(obj_file) for obj_file, _ in obj_asm_pairs]

Expand Down
Loading