wanwu/deer-flow
1
0
Fork 0
mirror of https://gitee.com/wanwujie/deer-flow synced 2026-04-02 22:02:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: use subprocess instead of os.system in analyze.py (#1289)

Browse Source 
The data analysis skill executes shell commands using os
Resolves V-001

Co-authored-by: orbisai0security <orbisai0security@users.noreply.github.com>
This commit is contained in:
orbisai0security
2026-03-24 18:12:03 +05:30
committed by GitHub
parent 4b15f14647
commit 14a3fa5290
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
scripts/check.py
View File

@@ -12,7 +12,7 @@ from typing import Optional
def run_command(command: list[str]) -> Optional[str]: def run_command(command: list[str]) -> Optional[str]:
"""Run a command and return trimmed stdout, or None on failure.""" """Run a command and return trimmed stdout, or None on failure."""
try: try:
result = subprocess.run(command, capture_output=True, text=True, check=True) result = subprocess.run(command, capture_output=True, text=True, check=True, shell=False)
except (OSError, subprocess.CalledProcessError): except (OSError, subprocess.CalledProcessError):
return None return None
return result.stdout.strip() or result.stderr.strip() return result.stdout.strip() or result.stderr.strip()

5
skills/public/data-analysis/scripts/analyze.py
View File

@@ -11,6 +11,7 @@ import json
import logging import logging
import os import os
import re import re
import subprocess
import sys import sys
import tempfile import tempfile
@@ -21,13 +22,13 @@ try:
import duckdb import duckdb
except ImportError: except ImportError:
logger.error("duckdb is not installed. Installing...") logger.error("duckdb is not installed. Installing...")
os.system(f"{sys.executable} -m pip install duckdb openpyxl -q") subprocess.run([sys.executable, "-m", "pip", "install", "duckdb", "openpyxl", "-q"], check=True)
import duckdb import duckdb
try: try:
import openpyxl # noqa: F401 import openpyxl # noqa: F401
except ImportError: except ImportError:
os.system(f"{sys.executable} -m pip install openpyxl -q") subprocess.run([sys.executable, "-m", "pip", "install", "openpyxl", "-q"], check=True)
# Cache directory for persistent DuckDB databases # Cache directory for persistent DuckDB databases
CACHE_DIR = os.path.join(tempfile.gettempdir(), ".data-analysis-cache") CACHE_DIR = os.path.join(tempfile.gettempdir(), ".data-analysis-cache")