-
-
Notifications
You must be signed in to change notification settings - Fork 16.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Removed shell=True from subprocess commands that require user inputs #7875
Conversation
… Also removed unused arguments
for more information, see https://pre-commit.ci
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
👋 Hello @JWLee89, thank you for submitting a YOLOv5 🚀 PR! To allow your work to be integrated as seamlessly as possible, we advise you to:
- ✅ Verify your PR is up-to-date with upstream/master. If your PR is behind upstream/master an automatic GitHub Actions merge may be attempted by writing /rebase in a new comment, or by running the following code, replacing 'feature' with the name of your local branch:
git remote add upstream https://github.com/ultralytics/yolov5.git
git fetch upstream
# git checkout feature # <--- replace 'feature' with local branch name
git merge upstream/master
git push -u origin -f
- ✅ Verify all Continuous Integration (CI) checks are passing.
- ✅ Reduce changes to the absolute minimum required for your bug fix or feature addition. "It is not daily increase but daily decrease, hack away the unessential. The closer to the source, the less wastage there is." -Bruce Lee
@JWLee89 PR is merged. Thank you for your contributions to YOLOv5 🚀 and Vision AI ⭐ |
@glenn-jocher Thank you for reviewing my PR. Looking forward to working on yolov5 during my downtime! |
…ltralytics#7875) * Removed shell=True from subprocess commands that require user inputs. Also removed unused arguments * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Added check=True * Revert line add Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Glenn Jocher <[email protected]>
…ltralytics#7875) * Removed shell=True from subprocess commands that require user inputs. Also removed unused arguments * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Added check=True * Revert line add Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Glenn Jocher <[email protected]>
@JWLee89 you're welcome! Our team is grateful for your valuable contributions to YOLOv5. Let us know if you have any questions or need assistance during your work on the project. Happy coding! |
This PR involves the following changes
shell=True
from subprocess calls where user-defined inputs are provided (to prevent possible unwanted injection)I ran the scripts after modification inside of the yolo docker container and checked manually to see if it works.
If needed I can also post serialized outputs and computational graph generated by netron.
🛠️ PR Summary
Made with ❤️ by Ultralytics Actions
🌟 Summary
Enhancements to model export functionality in 'ultralytics/yolov5.'
📊 Key Changes
model
andim
parameters from OpenVINO, TensorFlow GraphDef (pb), Edge TPU, and TensorFlow.js export functions.subprocess.check_output
andsubprocess.run
withshell=True
to use.split()
method, enhancing security and preventing shell injection vulnerabilities.🎯 Purpose & Impact
shell=True
prevents execution of arbitrary code, making exports more secure.