affirm our usage of subprocess.*

Author: mr-c

cwltool/singularity.py

@@ -26,11 +26,11 @@
 
 if os.name == 'posix':
     if sys.version_info < (3, 5):
-        from subprocess32 import (  # pylint: disable=import-error,no-name-in-module
+        from subprocess32 import (  # nosec # pylint: disable=import-error,no-name-in-module
             check_call, check_output, CalledProcessError, DEVNULL, PIPE, Popen,
             TimeoutExpired)
     else:
-        from subprocess import (  # pylint: disable=import-error,no-name-in-module
+        from subprocess import (  # nosec # pylint: disable=import-error,no-name-in-module
             check_call, check_output, CalledProcessError, DEVNULL, PIPE, Popen,
             TimeoutExpired)
 
@@ -44,7 +44,7 @@ def _singularity_supports_userns():  # type: ()->bool
     if _USERNS is None:
         try:
             hello_image = os.path.join(os.path.dirname(__file__), 'hello.simg')
-            result = Popen(
+            result = Popen(  # nosec
                 [u"singularity", u"exec", u"--userns", hello_image, u"true"],
                 stderr=PIPE, stdout=DEVNULL,
                 universal_newlines=True).communicate(timeout=60)[1]
@@ -110,7 +110,7 @@ def get_image(dockerRequirement,  # type: Dict[Text, Text]
                        str(dockerRequirement["dockerImageId"]),
                        str(dockerRequirement["dockerPull"])]
                 _logger.info(Text(cmd))
-                check_call(cmd, stdout=sys.stderr)
+                check_call(cmd, stdout=sys.stderr)  # nosec
                 found = True
             elif "dockerFile" in dockerRequirement:
                 raise WorkflowException(SourceLine(

cwltool/utils.py

@@ -24,11 +24,11 @@
 # no imports from cwltool allowed
 if os.name == 'posix':
     if sys.version_info < (3, 5):
-        import subprocess32 as subprocess  # pylint: disable=unused-import
+        import subprocess32 as subprocess  # nosec # pylint: disable=unused-import
     else:
-        import subprocess  # pylint: disable=unused-import
+        import subprocess  # nosec # pylint: disable=unused-import
 else:
-    import subprocess  # type: ignore
+    import subprocess  # type: ignore  # nosec
 
 windows_default_container_id = "frolvlad/alpine-bash"