mirror of
https://github.com/pocketpy/pocketpy
synced 2026-02-19 05:50:17 +00:00
- Replace os.system() calls with subprocess.run() using list args to avoid shell injection (CWE-78, Bandit B605/B607) - Replace assert-based error handling with proper exceptions (ValueError, RuntimeError, FileNotFoundError) that survive python -O (Bandit B101) - Use sys.executable instead of hardcoded 'python' to ensure correct interpreter (Bandit B607) Files changed: cmake_build.py, scripts/run_tests.py, compileall.py, amalgamate.py