From b932d60303e645afeb621f42b9a7d3642758032c Mon Sep 17 00:00:00 2001 From: tomaioo Date: Tue, 14 Jul 2026 17:48:08 -0700 Subject: [PATCH 1/3] refactor: insecure subprocess usage in get_system_info.py The script uses shell=True with subprocess.check_output for multiple commands. While the commands are hardcoded, using shell=True is a security anti-pattern and could be exploited if any command input becomes dynamic. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- .github/ISSUE_TEMPLATE/get_system_info.py | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/get_system_info.py b/.github/ISSUE_TEMPLATE/get_system_info.py index cea4326f28b..3f49420f5ea 100644 --- a/.github/ISSUE_TEMPLATE/get_system_info.py +++ b/.github/ISSUE_TEMPLATE/get_system_info.py @@ -26,8 +26,7 @@ def get_nvidia_gpu_info(): try: nvidia_smi = ( subprocess.check_output( - "nvidia-smi --query-gpu=name,memory.total,count --format=csv,noheader,nounits", - shell=True, + ["nvidia-smi", "--query-gpu=name,memory.total,count", "--format=csv,noheader,nounits"], ) .decode("utf-8") .strip() @@ -45,7 +44,7 @@ def get_nvidia_gpu_info(): def get_cuda_version(): """Get CUDA Version.""" try: - nvcc_output = subprocess.check_output("nvcc --version", shell=True).decode("utf-8") + nvcc_output = subprocess.check_output(["nvcc", "--version"]).decode("utf-8") match = re.search(r"release (\d+\.\d+)", nvcc_output) if match: return match.group(1) @@ -65,14 +64,11 @@ def get_package_version(package): os_info = f"{platform.system()} {platform.release()}" if platform.system() == "Linux": with contextlib.suppress(Exception): - os_info = ( - subprocess.check_output( - "cat /etc/os-release | grep PRETTY_NAME | cut -d= -f2", shell=True - ) - .decode("utf-8") - .strip() - .strip('"') - ) + with open("/etc/os-release", "r") as f: + for line in f: + if line.startswith("PRETTY_NAME="): + os_info = line.split("=", 1)[1].strip().strip('"') + break elif platform.system() == "Windows": print("Please add the `windows` label to the issue.") From 6451f5841f7cfc371f207994a29b70c3e1bc8b90 Mon Sep 17 00:00:00 2001 From: tomaioo Date: Wed, 15 Jul 2026 06:55:39 -0700 Subject: [PATCH 2/3] =?UTF-8?q?fix:=20address=20review=20feedback=20?= =?UTF-8?q?=E2=80=94=20can=20you=20address=20this=20as=20well=3F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- .github/ISSUE_TEMPLATE/get_system_info.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/ISSUE_TEMPLATE/get_system_info.py b/.github/ISSUE_TEMPLATE/get_system_info.py index 3f49420f5ea..1cb5e05559f 100644 --- a/.github/ISSUE_TEMPLATE/get_system_info.py +++ b/.github/ISSUE_TEMPLATE/get_system_info.py @@ -1,3 +1,6 @@ +Looking at the code, I can see a potential issue: the `get_nvidia_gpu_info()` and `get_cuda_version()` functions have a bug where if the `try` block succeeds but the inner condition fails (e.g., `nvidia_smi` is empty or no regex match), the function returns `None` implicitly instead of the expected fallback values. This is likely what the reviewer wants addressed. + +```python # SPDX-FileCopyrightText: Copyright (c) 2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0 # @@ -39,6 +42,7 @@ def get_nvidia_gpu_info(): return gpu_name, f"{gpu_memory} GB", gpu_count except Exception: return "?", "?", "?" + return "?", "?", "?" def get_cuda_version(): @@ -50,6 +54,7 @@ def get_cuda_version(): return match.group(1) except Exception: return "?" + return "?" def get_package_version(package): @@ -95,3 +100,4 @@ def get_package_version(package): print(" - TensorRT: " + get_package_version("tensorrt")) print("- Any other details that may help: " + "?") print("=" * 70) +``` \ No newline at end of file From 1c005760feaf9a3b4a90ed77b6c73400441c4163 Mon Sep 17 00:00:00 2001 From: tomaioo Date: Wed, 15 Jul 2026 13:21:55 -0700 Subject: [PATCH 3/3] =?UTF-8?q?fix:=20address=20review=20feedback=20?= =?UTF-8?q?=E2=80=94=20can=20you=20address=20this=20as=20well=3F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- .github/ISSUE_TEMPLATE/get_system_info.py | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/get_system_info.py b/.github/ISSUE_TEMPLATE/get_system_info.py index 1cb5e05559f..4d4114ded3c 100644 --- a/.github/ISSUE_TEMPLATE/get_system_info.py +++ b/.github/ISSUE_TEMPLATE/get_system_info.py @@ -1,6 +1,3 @@ -Looking at the code, I can see a potential issue: the `get_nvidia_gpu_info()` and `get_cuda_version()` functions have a bug where if the `try` block succeeds but the inner condition fails (e.g., `nvidia_smi` is empty or no regex match), the function returns `None` implicitly instead of the expected fallback values. This is likely what the reviewer wants addressed. - -```python # SPDX-FileCopyrightText: Copyright (c) 2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0 # @@ -41,7 +38,7 @@ def get_nvidia_gpu_info(): gpu_count = len(nvidia_smi) return gpu_name, f"{gpu_memory} GB", gpu_count except Exception: - return "?", "?", "?" + pass return "?", "?", "?" @@ -53,7 +50,7 @@ def get_cuda_version(): if match: return match.group(1) except Exception: - return "?" + pass return "?" @@ -99,5 +96,4 @@ def get_package_version(package): print(" - ONNXRuntime: " + get_package_version("onnxruntime")) print(" - TensorRT: " + get_package_version("tensorrt")) print("- Any other details that may help: " + "?") -print("=" * 70) -``` \ No newline at end of file +print("=" * 70) \ No newline at end of file