add rule

pyproject.toml

@@ -11,6 +11,8 @@ select = [
     "D301",  # Use `r"""` if any backslashes in a docstring
     "D403",  # [*] First word of the first line should be capitalized
     "PERF102",  # [*] When using only the keys of a dict use the `keys()` method
+    "S113",  # Probable use of requests call without timeout
+    "S602",  # `subprocess` call with `shell=True` identified, security issue
 ]
 ignore = [
     "A",  # flake8-builtins

scripts/internal/download_wheels_github.py

@@ -32,20 +32,23 @@
 PROJECT_VERSION = __version__
 OUTFILE = "wheels-github.zip"
 TOKEN = ""
+TIMEOUT = 30
 
 
 def get_artifacts():
     base_url = "https://api.github.com/repos/%s/%s" % (USER, PROJECT)
     url = base_url + "/actions/artifacts"
-    res = requests.get(url=url, headers={"Authorization": "token %s" % TOKEN})
+    res = requests.get(url=url, headers={
+                       "Authorization": "token %s" % TOKEN}, timeout=TIMEOUT)
     res.raise_for_status()
     data = json.loads(res.content)
     return data
 
 
 def download_zip(url):
     print("downloading: " + url)
-    res = requests.get(url=url, headers={"Authorization": "token %s" % TOKEN})
+    res = requests.get(url=url, headers={
+                       "Authorization": "token %s" % TOKEN}, timeout=TIMEOUT)
     res.raise_for_status()
     totbytes = 0
     with open(OUTFILE, 'wb') as f:

scripts/internal/winmake.py

@@ -19,6 +19,7 @@
 import errno
 import fnmatch
 import os
+import shlex
 import shutil
 import site
 import ssl
@@ -115,7 +116,9 @@ def win_colorprint(s, color=LIGHTBLUE):
 def sh(cmd, nolog=False):
     if not nolog:
         safe_print("cmd: " + cmd)
-    p = subprocess.Popen(cmd, shell=True, env=os.environ, cwd=os.getcwd())
+    if isinstance(cmd, str):
+        cmd = shlex.split(cmd)
+    p = subprocess.Popen(cmd, env=os.environ, cwd=os.getcwd())
     p.communicate()
     if p.returncode != 0:
         sys.exit(p.returncode)