Skip to content

fix: bare except clauses + shell=True injection risk#1823

Merged
Scottcjn merged 2 commits into
Scottcjn:mainfrom
AliaksandrNazaruk:fix/bare-except-and-shell-injection
Mar 24, 2026
Merged

fix: bare except clauses + shell=True injection risk#1823
Scottcjn merged 2 commits into
Scottcjn:mainfrom
AliaksandrNazaruk:fix/bare-except-and-shell-injection

Conversation

@AliaksandrNazaruk
Copy link
Copy Markdown
Contributor

@AliaksandrNazaruk AliaksandrNazaruk commented Mar 24, 2026

Fixes #1822. Replace bare except with except Exception in 4 node modules. Replace shell=True with shlex.split in get_hardware_serial.py. Claiming bounty #305 (Medium, 10 RTC).

web-flow added 2 commits March 24, 2026 16:42
@web-flow
feat: BCOS Badge Generator web tool (#2292)
05c110a 
Static HTML/JS badge generator at web/bcos/badge-generator.html

- Enter repo URL or BCOS cert ID to generate badge
- Preview badge inline
- Copy markdown, HTML, or raw URL embed code
- Three badge styles: flat, flat-square, for-the-badge
- Vintage terminal aesthetic matching rustchain.org
- No backend needed — calls /bcos/verify API
- MIT licensed
@web-flow
fix: replace bare except clauses and shell=True injection risk
d1ee815 
- Replace 'except:' with 'except Exception:' in fingerprint_checks.py,
  get_hardware_serial.py, rip_proof_of_antiquity_hardware.py, rip_node_sync.py
- Replace shell=True with shlex.split() in get_hardware_serial.py
- Fixes #1822 (bug bounty #305)
@github-actions github-actions Bot added BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related size/L PR: 201-500 lines labels Mar 24, 2026
@Scottcjn Scottcjn merged commit e66d3eb into Scottcjn:main Mar 24, 2026
3 checks passed
@AliaksandrNazaruk AliaksandrNazaruk mentioned this pull request Mar 26, 2026
Merged
@AliaksandrNazaruk
Copy link
Copy Markdown
Contributor Author

AliaksandrNazaruk commented Mar 26, 2026

Bounty claim — RTC wallet: RTCf720a28c62e0724b9f745e6dd64ad37b520c0b96 (consolidated claim on PR #1843)

FlintLeng
FlintLeng approved these changes Apr 24, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@FlintLeng FlintLeng left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work on this PR — clean implementation with good attention to edge cases.

@FlintLeng FlintLeng mentioned this pull request Apr 24, 2026
Closed
FlintLeng
FlintLeng reviewed Apr 24, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@FlintLeng FlintLeng left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR #1823 — Review:

Bare except → except Exception. Best practice fix — bare except catches SystemExit and KeyboardInterrupt which should propagate. This is a standard Python lint fix. ✅

@FlintLeng FlintLeng mentioned this pull request Apr 24, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Scottcjn Scottcjn Awaiting requested review from Scottcjn Scottcjn is a code owner

1 more reviewer

@FlintLeng FlintLeng FlintLeng approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related size/L PR: 201-500 lines

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[BUG] shell=True injection risk + bare except silencing in node modules

4 participants

@AliaksandrNazaruk @FlintLeng @Scottcjn @web-flow