subprocess with shell=True

[hanchl]

Horizon uses subprocess with shell=True in openstack_dashboard\management\commands\extract_messages.py and openstack_dashboard\management\commands\update_catalog.py in function handle

Handle contains command with a double quote, either accidentally or maliciously, the command will be executed with shell=True. Bandit think it's insecure. For more information on subprocess, shell=True and command injection see: https://docs.python.org/2/library/subprocess.html#frequently-used-arguments

[Akihiro Motoki (amotoki)]

This looks like a generic warning on shell=True for subprocess and there is no practical suggestion.
shell=True is used in udpate_catalog and extract_catalog but they need to be executed on a shell. We cannot run these commands without shell=True. These commands are used only for maintenance by operators and there is no chance to inject malicious commands.