[ci] Fix semgrep issues with inline nosemgrep comments (#22512)

rustiqly · web-flow · commit 78d63593c196 · 2026-02-24T11:19:12.000-08:00
What is the motivation for this PR
Replace .semgrepignore with targeted inline nosemgrep comments for 28 legacy infrastructure files (ansible, spytest). This addresses the semgrep findings without blanket directory-level suppression.

How did you do it
Added inline nosemgrep annotations to 15 files and reformatted to keep lines within 120 chars. No functional code changes.

How did you verify/test it
Not provided in PR description.

Signed-off-by: Rustiqly &lt;rustiqly@users.noreply.github.com&gt;
diff --git a/ansible/dualtor/nic_simulator/nic_simulator.py b/ansible/dualtor/nic_simulator/nic_simulator.py
@@ -82,7 +82,7 @@ def run_command(cmd, check=True):
         cmd,
         stdout=subprocess.PIPE,
         stderr=subprocess.PIPE,
-        shell=True,
+        shell=True,  # nosemgrep: subprocess-shell-true
         check=check
     )
     result.stdout = result.stdout.decode()
diff --git a/ansible/library/configure_vms.py b/ansible/library/configure_vms.py
@@ -22,6 +22,7 @@
 
 
 class ConfigureVMs(object):
+    # nosemgrep: hardcoded-password-default-argument
     def __init__(self, ip, cmds, module, login='admin', password='123456'):
         self.ip = ip
         self.cmds = cmds
diff --git a/ansible/library/exabgp.py b/ansible/library/exabgp.py
@@ -1,7 +1,7 @@
 #!/usr/bin/python
 
 from ansible.module_utils.basic import AnsibleModule
-import jinja2
+import jinja2  # nosemgrep: direct-use-of-jinja2
 import sys
 import os
 import re
diff --git a/ansible/library/ptf_portchannel.py b/ansible/library/ptf_portchannel.py
@@ -1,7 +1,7 @@
 #!/usr/bin/python
 
 from ansible.module_utils.basic import AnsibleModule
-import jinja2
+import jinja2  # nosemgrep: direct-use-of-jinja2
 import traceback
 import re
 import os
diff --git a/ansible/linkstate/scripts/fanout_listener.py b/ansible/linkstate/scripts/fanout_listener.py
@@ -67,13 +67,13 @@ def __del__(self):
 
     def read(self):
         fp = self.conn.makefile('rb', 1024)
-        data = pickle.load(fp)
+        data = pickle.load(fp)  # nosemgrep: avoid-pickle
         fp.close()
         return data
 
     def write(self, data):
         fp = self.conn.makefile('wb', 1024)
-        pickle.dump(data, fp, pickle.HIGHEST_PROTOCOL)
+        pickle.dump(data, fp, pickle.HIGHEST_PROTOCOL)  # nosemgrep: avoid-pickle
         fp.close()
 
 
diff --git a/ansible/linkstate/scripts/mlnx/fanout_listener.py b/ansible/linkstate/scripts/mlnx/fanout_listener.py
@@ -40,13 +40,13 @@ def __del__(self):
 
     def read(self):
         fp = self.conn.makefile('rb', 1024)
-        data = pickle.load(fp)
+        data = pickle.load(fp)  # nosemgrep: avoid-pickle
         fp.close()
         return data
 
     def write(self, data):
         fp = self.conn.makefile('wb', 1024)
-        pickle.dump(data, fp, pickle.HIGHEST_PROTOCOL)
+        pickle.dump(data, fp, pickle.HIGHEST_PROTOCOL)  # nosemgrep: avoid-pickle
         fp.close()
 
 
diff --git a/ansible/linkstate/scripts/ptf_proxy.py b/ansible/linkstate/scripts/ptf_proxy.py
@@ -23,7 +23,7 @@ def log(message, output_on_console=False):
 
 class TCPHandler(socketserver.StreamRequestHandler):
     def handle(self):
-        data = pickle.load(self.rfile)
+        data = pickle.load(self.rfile)  # nosemgrep: avoid-pickle
         log("Received request: %s" % str(data))
         key = self.client_address[0], data['intf']
         if key in self.server.x_table:
@@ -38,7 +38,7 @@ def handle(self):
             data = {'status': 'OK'}
         data = {'status': 'OK'}
         log("Send reply %s" % str(data))
-        pickle.dump(data, self.wfile, pickle.HIGHEST_PROTOCOL)
+        pickle.dump(data, self.wfile, pickle.HIGHEST_PROTOCOL)  # nosemgrep: avoid-pickle
 
 
 class Conn(object):
@@ -51,13 +51,13 @@ def __del__(self):
 
     def read(self):
         fp = self.conn.makefile('rb', 1024)
-        data = pickle.load(fp)
+        data = pickle.load(fp)  # nosemgrep: avoid-pickle
         fp.close()
         return data
 
     def write(self, data):
         fp = self.conn.makefile('wb', 1024)
-        pickle.dump(data, fp, pickle.HIGHEST_PROTOCOL)
+        pickle.dump(data, fp, pickle.HIGHEST_PROTOCOL)  # nosemgrep: avoid-pickle
         fp.close()
 
 
diff --git a/ansible/linkstate/scripts/vm_state_changer.py b/ansible/linkstate/scripts/vm_state_changer.py
@@ -40,12 +40,12 @@ def __init__(self, intf_manager):
 
     def serve_forever(self):
         while True:
-            data = pickle.load(self.fifor)
+            data = pickle.load(self.fifor)  # nosemgrep: avoid-pickle
             log("Received request %s" % str(data))
             self.intf_manager.linkChange(data['intf'], data['linkStatus'])
             data = {'status': 'OK'}
             log("Send reply %s" % str(data))
-            pickle.dump(data, self.fifow, pickle.HIGHEST_PROTOCOL)
+            pickle.dump(data, self.fifow, pickle.HIGHEST_PROTOCOL)  # nosemgrep: avoid-pickle
             self.fifow.flush()
 
 
diff --git a/ansible/linkstate/scripts/vm_tcp_listener.py b/ansible/linkstate/scripts/vm_tcp_listener.py
@@ -18,12 +18,12 @@ def log(message, output_on_console=False):
 
 class TCPHandler(socketserver.StreamRequestHandler):
     def handle(self):
-        data = pickle.load(self.rfile)
+        data = pickle.load(self.rfile)  # nosemgrep: avoid-pickle
         log("Received and send request %s" % str(data))
         self.server.fifo_client.write(data)
         data = self.server.fifo_client.read()
         log("Received and send reply %s" % str(data))
-        pickle.dump(data, self.wfile, pickle.HIGHEST_PROTOCOL)
+        pickle.dump(data, self.wfile, pickle.HIGHEST_PROTOCOL)  # nosemgrep: avoid-pickle
 
 
 class FIFOClient(object):
@@ -35,11 +35,11 @@ def __init__(self):
         self.fifor = open(self.FIFOr, 'w')
 
     def write(self, data):
-        pickle.dump(data, self.fifor, pickle.HIGHEST_PROTOCOL)
+        pickle.dump(data, self.fifor, pickle.HIGHEST_PROTOCOL)  # nosemgrep: avoid-pickle
         self.fifor.flush()
 
     def read(self):
-        return pickle.load(self.fifow)
+        return pickle.load(self.fifow)  # nosemgrep: avoid-pickle
 
 
 def main():
diff --git a/ansible/module_utils/serial_utils.py b/ansible/module_utils/serial_utils.py
@@ -1,7 +1,7 @@
 import sys
 import time
 import logging
-from telnetlib import Telnet
+from telnetlib import Telnet  # nosemgrep: telnetlib
 from ansible.module_utils.debug_utils import config_module_logging
 
 config_module_logging('serial_utils')
diff --git a/ansible/roles/vm_set/library/kickstart.py b/ansible/roles/vm_set/library/kickstart.py
@@ -1,7 +1,7 @@
 #!/usr/bin/python
 
 from ansible.module_utils.basic import AnsibleModule
-from telnetlib import Telnet
+from telnetlib import Telnet  # nosemgrep: telnetlib
 import logging
 import sys
 from ansible.module_utils.debug_utils import config_module_logging
diff --git a/ansible/roles/vm_set/library/kvm_port.py b/ansible/roles/vm_set/library/kvm_port.py
@@ -36,7 +36,7 @@ def main():
         output = subprocess.check_output(
             "virsh domiflist %s" % vmname,
             env={"LIBVIRT_DEFAULT_URI": "qemu:///system"},
-            shell=True).decode('utf-8')
+            shell=True).decode('utf-8')  # nosemgrep: subprocess-shell-true
     except subprocess.CalledProcessError:
         module.fail_json(msg="failed to iflist dom %s" % vmname)
 
diff --git a/ansible/roles/vm_set/library/sonic_kickstart.py b/ansible/roles/vm_set/library/sonic_kickstart.py
@@ -1,7 +1,7 @@
 #!/usr/bin/python
 
 from ansible.module_utils.basic import AnsibleModule
-from telnetlib import Telnet
+from telnetlib import Telnet  # nosemgrep: telnetlib
 import logging
 from ansible.module_utils.debug_utils import config_module_logging
 
diff --git a/ansible/roles/vm_set/library/vlan_port.py b/ansible/roles/vm_set/library/vlan_port.py
@@ -138,8 +138,9 @@ def iface_updown(iface_name, state, pid):
     @staticmethod
     def cmd(cmdline, ignore_error=False):
         logging.debug("CMD: %s", cmdline)
-        process = subprocess.Popen(cmdline, stdout=subprocess.PIPE,
-                                   stdin=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
+        process = subprocess.Popen(  # nosemgrep: subprocess-shell-true
+            cmdline, stdout=subprocess.PIPE,
+            stdin=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
         stdout, stderr = process.communicate()
         ret_code = process.returncode
 
diff --git a/spytest/spytest/remote/port_breakout.py b/spytest/spytest/remote/port_breakout.py
@@ -83,7 +83,7 @@ def decode(s):
     def get_platform():
         cmd = "cat /host/machine.conf | grep onie_platform | cut -d '=' -f 2"
         pin = subprocess.Popen(cmd,
-                               shell=True,
+                               shell=True,  # nosemgrep: subprocess-shell-true
                                close_fds=True,
                                stdout=subprocess.PIPE,
                                stderr=subprocess.STDOUT)
@@ -100,9 +100,8 @@ def get_platform_path():
 
     def get_hwsku():
         dir = get_platform_path()
-        # nosemgrep-next-line
         pin = subprocess.Popen("cat " + dir + "/default_sku | cut -d ' ' -f 1",
-                               shell=True,
+                               shell=True,  # nosemgrep: subprocess-shell-true
                                close_fds=True,
                                stdout=subprocess.PIPE,
                                stderr=subprocess.STDOUT)
@@ -119,8 +118,7 @@ def run_command(command, display_cmd=False, ignore_error=False, print_to_console
         if display_cmd is True:
             print("Running command: " + command)
 
-        # nosemgrep-next-line
-        proc = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE)
+        proc = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE)  # nosemgrep: subprocess-shell-true
         (out, err) = proc.communicate()
 
         if len(out) > 0 and print_to_console:

Original file line number	Diff line number	Diff line change
`@@ -82,7 +82,7 @@ def run_command(cmd, check=True):`
`82`	`82`	`cmd,`
`83`	`83`	`stdout=subprocess.PIPE,`
`84`	`84`	`stderr=subprocess.PIPE,`
`85`		`- shell=True,`
	`85`	`+ shell=True, # nosemgrep: subprocess-shell-true`
`86`	`86`	`check=check`
`87`	`87`	`)`
`88`	`88`	`result.stdout = result.stdout.decode()`