Summary
A main-branch Sonar finding traces previous-tag input to the Git subprocess helper in scripts/vscode_release_notes.py. Existing validation suggests a false positive, but the trust boundary needs an explicit proof before disposition.
Reproduction steps
Inspect Sonar rule pythonsecurity:S8705 for scripts/vscode_release_notes.py and trace callers from --previous-tag through generate, old_lockfile and old_package.
Expected behavior
Invalid tags are rejected before a subprocess starts; valid release tags keep the existing git show semantics. Resolve the Sonar finding only after verifying its data flow.
Actual behavior
No shell injection was demonstrated. The helper uses argument lists and callers require STABLE_TAG.fullmatch, but the issue remains open.
Logs and output
Sonar issue keys: AaCK61tceMZvS3_EWBJE.
Version / commit
ff07368 (main baseline).
Environment
SonarQube Cloud project ben-ranford_lopper; baseline analysis 5a0cdcfb-5c8c-4dae-a90d-d0de97975465, inspected 2026-09-15.
Scope and acceptance criteria
Add a CLI-level invalid-tag probe that asserts no subprocess execution. Review every exported-helper caller and release workflow input. If the finding is false, document the exact proof for a justified Sonar disposition; otherwise repair the demonstrated path. Do not add shell quoting to an argument-list API.
Release assignment
This is a bounded evidence and analysis-disposition task assigned to the next patch milestone, v1.8.9. It is outside the acceptance criteria of the current v1.8.8 PRs.
Live Sonar findings
Summary
A main-branch Sonar finding traces previous-tag input to the Git subprocess helper in scripts/vscode_release_notes.py. Existing validation suggests a false positive, but the trust boundary needs an explicit proof before disposition.
Reproduction steps
Inspect Sonar rule pythonsecurity:S8705 for scripts/vscode_release_notes.py and trace callers from --previous-tag through generate, old_lockfile and old_package.
Expected behavior
Invalid tags are rejected before a subprocess starts; valid release tags keep the existing git show semantics. Resolve the Sonar finding only after verifying its data flow.
Actual behavior
No shell injection was demonstrated. The helper uses argument lists and callers require STABLE_TAG.fullmatch, but the issue remains open.
Logs and output
Sonar issue keys: AaCK61tceMZvS3_EWBJE.
Version / commit
ff07368 (main baseline).
Environment
SonarQube Cloud project ben-ranford_lopper; baseline analysis 5a0cdcfb-5c8c-4dae-a90d-d0de97975465, inspected 2026-09-15.
Scope and acceptance criteria
Add a CLI-level invalid-tag probe that asserts no subprocess execution. Review every exported-helper caller and release workflow input. If the finding is false, document the exact proof for a justified Sonar disposition; otherwise repair the demonstrated path. Do not add shell quoting to an argument-list API.
Release assignment
This is a bounded evidence and analysis-disposition task assigned to the next patch milestone, v1.8.9. It is outside the acceptance criteria of the current v1.8.8 PRs.
Live Sonar findings