Skip to content

Commit

Permalink
Merge branch 'SONARIAC-1856' of https://github.com/SonarSource/rspec
Browse files Browse the repository at this point in the history
…into SONARIAC-1856
  • Loading branch information
rudy-regazzoni-sonarsource committed Jan 8, 2025
2 parents 2b73aba + dd2372c commit c4b533b
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 7 deletions.
4 changes: 2 additions & 2 deletions rules/S3649/python/how-to-fix-it/sqlalchemy.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ import sqlalchemy
@app.route('/example')
def get_users():
user = request.args["user"]
conn = sqlalchemy.create_engine(connection_string)
engine = sqlalchemy.create_engine(connection_string)
conn = engine.connect()
conn.execute("SELECT user FROM users WHERE user = '" + user + "'") # Noncompliant
Expand All @@ -43,7 +43,7 @@ import sqlalchemy
@app.route('/example')
def get_users():
user = request.args["user"]
conn = sqlalchemy.create_engine(connection_string)
engine = sqlalchemy.create_engine(connection_string)
metadata = sqlalchemy.MetaData(bind=conn, reflect=True)
users = metadata.tables['users']
conn = engine.connect()
Expand Down
12 changes: 7 additions & 5 deletions rules/S7019/docker/rule.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,16 @@ This can cause problems when trying to gracefully stop containers because the ma
Moreover, the exec form provides more control and predictability over the execution of the command.
It does not invoke a command shell, which means it does not have the potential side effects of shell processing.

Although, the exec form does not allow shell features such as variable expansion, piping (`|`) and command chaining (`&&`, `||`, `;`).
In case you need to use these features, there is few alternatives:
- create a wrapper script
- explicitly specify the shell with the `SHELL` instruction before the `CMD` or `ENTRYPOINT` instruction

=== Exceptions

As mentioned above, this rule will not raise an issue if the `SHELL` instruction is used before the `CMD` or `ENTRYPOINT` instruction, as we consider this is a conscious decision.
The exec form does not allow shell features such as variable expansion, piping (`|`) and command chaining (`&&`, `||`, `;`).
In case you need to use these features, there are a few alternatives:
* Creation of a wrapper script
* Explicitly specify the shell to use with the `SHELL` instruction before `CMD` or `ENTRYPOINT`


This rule will not raise an issue if the `SHELL` instruction is used before the `CMD` or `ENTRYPOINT` instruction, as we consider this a conscious decision.

== How to fix it

Expand Down

0 comments on commit c4b533b

Please sign in to comment.