From f40eb9a9a2242fe91d4b95632d4be80ac75a5c5e Mon Sep 17 00:00:00 2001
From: Josh Usiskin <56369778+jusiskin@users.noreply.github.com>
Date: Wed, 27 Sep 2023 18:52:25 +0000
Subject: [PATCH] chore: remove shell usage in shutdown subprocess

Signed-off-by: Josh Usiskin <56369778+jusiskin@users.noreply.github.com>
---
 src/deadline_worker_agent/startup/entrypoint.py |  7 +++----
 test/unit/startup/test_entrypoint.py            | 14 ++++++--------
 2 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/src/deadline_worker_agent/startup/entrypoint.py b/src/deadline_worker_agent/startup/entrypoint.py
index 79335d9c..55956d27 100644
--- a/src/deadline_worker_agent/startup/entrypoint.py
+++ b/src/deadline_worker_agent/startup/entrypoint.py
@@ -206,12 +206,12 @@ def _system_shutdown(config: Configuration) -> None:
 
     _logger.info("Shutting down the instance")
 
-    shutdown_command = None
+    shutdown_command: list[str]
 
     if sys.platform == "win32":
-        shutdown_command = "shutdown -s"
+        shutdown_command = ["shutdown", "-s"]
     else:
-        shutdown_command = "sudo shutdown now"
+        shutdown_command = ["sudo", "shutdown", "now"]
 
     if config.no_shutdown:
         _logger.debug(
@@ -227,7 +227,6 @@ def _system_shutdown(config: Configuration) -> None:
         shutdown_command,
         stdout=subprocess.PIPE,
         stderr=subprocess.STDOUT,
-        shell=True,
     )
     stdout, _ = process.communicate()
     command_output = stdout.decode("utf-8")
diff --git a/test/unit/startup/test_entrypoint.py b/test/unit/startup/test_entrypoint.py
index c9f4bc7f..964c16bd 100644
--- a/test/unit/startup/test_entrypoint.py
+++ b/test/unit/startup/test_entrypoint.py
@@ -419,8 +419,8 @@ def test_system_shutdown_called(
 @pytest.mark.parametrize(
     ("expected_platform", "expected_command"),
     (
-        pytest.param("win32", "shutdown -s", id="windows"),
-        pytest.param("linux", "sudo shutdown now", id="linux"),
+        pytest.param("win32", ["shutdown", "-s"], id="windows"),
+        pytest.param("linux", ["sudo", "shutdown", "now"], id="linux"),
     ),
 )
 @patch.object(entrypoint_mod._logger, "info")
@@ -449,7 +449,6 @@ def test_system_shutdown(
     logger_info_mock.assert_any_call("Shutting down the instance")
     subprocess_popen_mock.assert_called_once_with(
         expected_command,
-        shell=True,
         stdout=subprocess.PIPE,
         stderr=subprocess.STDOUT,
     )
@@ -458,8 +457,8 @@ def test_system_shutdown(
 @pytest.mark.parametrize(
     ("expected_platform", "expected_command"),
     (
-        pytest.param("win32", "shutdown -s", id="windows"),
-        pytest.param("linux", "sudo shutdown now", id="linux"),
+        pytest.param("win32", ["shutdown", "-s"], id="windows"),
+        pytest.param("linux", ["sudo", "shutdown", "now"], id="linux"),
     ),
 )
 @patch.object(entrypoint_mod, "_logger")
@@ -495,7 +494,6 @@ def test_system_shutdown_failure(
     logger_mock.info.assert_any_call("Shutting down the instance")
     subprocess_popen_mock.assert_called_once_with(
         expected_command,
-        shell=True,
         stdout=subprocess.PIPE,
         stderr=subprocess.STDOUT,
     )
@@ -509,8 +507,8 @@ def test_system_shutdown_failure(
 @pytest.mark.parametrize(
     ("expected_platform", "expected_command"),
     (
-        pytest.param("win32", "shutdown -s", id="windows"),
-        pytest.param("linux", "sudo shutdown now", id="linux"),
+        pytest.param("win32", ["shutdown", "-s"], id="windows"),
+        pytest.param("linux", ["sudo", "shutdown", "now"], id="linux"),
     ),
 )
 @patch.object(entrypoint_mod._logger, "debug")