[bandit]
# B603 (subprocess call without shell=True) is reported for every list-form
# subprocess call, including correct ones. This plugin makes exactly one:
# DwgConvertTask.run() invokes the ODA File Converter to turn the intermediate
# DXF into a DWG. It is safe by construction and has been reviewed:
#
#   * the command is a LIST and shell=False, so nothing in any argument is
#     shell-interpreted - the injection vector B603 warns about cannot occur;
#   * the executable is the path the user chose themselves in a file dialog
#     (QSettings ClipToDwg/oda_converter_path) and is checked with
#     os.path.exists() immediately before launch;
#   * the two directory arguments are tempfile.mkdtemp() results and every
#     remaining argument is a string literal;
#   * the call carries a 300 second timeout.
#
# There is no code change that clears this finding while still running an
# external converter, which the plugin exists to do.
skips = B603
