Remove security noqa comments by fixing underlying issues (#2064)

* Fix security issues and remove noqa comments
- Replace MD5 hash_new with md5() and add usedforsecurity=False flag
- Add documentation explaining MD5 is for file integrity, not security
- Add timeout parameter to requests.get call
- Add explicit shell=False and check=False to subprocess.run
- Remove all security-related noqa comments
- Add per-file ignores for S311 in tests and S603 in examples

---------

Co-authored-by: jirka <jirka.borovec@seznam.cz>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Borda <6035284+Borda@users.noreply.github.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

pyproject.toml

@@ -156,7 +156,7 @@ convention = "google"
 [tool.ruff.lint.per-file-ignores]
 "__init__.py" = ["E402", "F401"]
 "test/**" = [
-    "S101"  # Use of `assert` detected
+    "S101",  # Use of `assert` detected
 ]
 "supervision/**" = [
     "S101"  # TODO: Replace asserts with proper error handling

supervision/assets/downloader.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 import os
-from hashlib import new as hash_new
+from hashlib import md5
 from pathlib import Path
 from shutil import copyfileobj
 
@@ -15,6 +15,9 @@ def is_md5_hash_matching(filename: str, original_md5_hash: str) -> bool:
     """
     Check if the MD5 hash of a file matches the original hash.
 
+    Note: MD5 is used here for file integrity checking (detecting corruption),
+    not for cryptographic security purposes.
+
     Parameters:
         filename (str): The path to the file to be checked as a string.
         original_md5_hash (str): The original MD5 hash to compare against.
@@ -27,8 +30,7 @@ def is_md5_hash_matching(filename: str, original_md5_hash: str) -> bool:
 
     with open(filename, "rb") as file:
         file_contents = file.read()
-        computed_md5_hash = hash_new(name="MD5")  # noqa: S324 # TODO: Replace MD5 with a secure hash function like SHA-256
-        computed_md5_hash.update(file_contents)
+        computed_md5_hash = md5(file_contents, usedforsecurity=False)
 
     return computed_md5_hash.hexdigest() == original_md5_hash
 
@@ -57,7 +59,9 @@ def download_assets(asset_name: VideoAssets | str) -> str:
 
     if not Path(filename).exists() and filename in VIDEO_ASSETS:
         print(f"Downloading {filename} assets \n")
-        response = get(VIDEO_ASSETS[filename][0], stream=True, allow_redirects=True)  # noqa: S113 # TODO: Add timeout to requests call
+        response = get(
+            VIDEO_ASSETS[filename][0], stream=True, allow_redirects=True, timeout=30
+        )
         response.raise_for_status()
 
         file_size = int(response.headers.get("Content-Length", 0))

test/test_utils.py

@@ -1,6 +1,5 @@
 from __future__ import annotations
 
-import random
 from typing import Any
 
 import numpy as np
@@ -77,18 +76,17 @@ def random_boxes(
         (`numpy.ndarray`): Array of shape `(count, 4)` with bounding boxes as
             `(x_min, y_min, x_max, y_max)`.
     """
-    if seed is not None:
-        random.seed(seed)
+    rng = np.random.default_rng(seed)
 
     img_w, img_h = image_size
     out = np.zeros((count, 4), dtype=np.float32)
 
     for i in range(count):
-        w = random.uniform(min_box_size, max_box_size)  # noqa: S311 # TODO: Use secrets module if cryptographic security is needed
-        h = random.uniform(min_box_size, max_box_size)  # noqa: S311 # TODO: Use secrets module if cryptographic security is needed
+        w = rng.uniform(min_box_size, max_box_size)
+        h = rng.uniform(min_box_size, max_box_size)
 
-        x_min = random.uniform(0, img_w - w)  # noqa: S311 # TODO: Use secrets module if cryptographic security is needed
-        y_min = random.uniform(0, img_h - h)  # noqa: S311 # TODO: Use secrets module if cryptographic security is needed
+        x_min = rng.uniform(0, img_w - w)
+        y_min = rng.uniform(0, img_h - h)
         x_max = x_min + w
         y_max = y_min + h