Dispatch CustomResourceConfig through the v2 GLT trainer + inferencer

[kmontemayor2-sc]

Routes the custom oneof arm of TrainerResourceConfig /
InferencerResourceConfig to launch_custom from the v2 GLT
entrypoints, alongside the existing Vertex AI single-pool / graph-
store / local branches. With this in place, callers can swap any
trainer or inferencer onto a shell-command launcher by populating
the custom_*_config field on their resource config; no further
GiGL-side change is required.

[kmontemayor2-sc]

/all_test

[github-actions]

GiGL Automation

@ 23:09:28UTC : 🔄 Python Unit Test started.

@ 24:10:53UTC : ✅ Workflow completed successfully.

[github-actions]

GiGL Automation

@ 23:09:30UTC : 🔄 Scala Unit Test started.

@ 23:19:49UTC : ✅ Workflow completed successfully.

[github-actions]

GiGL Automation

@ 23:09:32UTC : 🔄 Lint Test started.

@ 23:16:26UTC : ❌ Workflow failed.
Please check the logs for more details.

[github-actions]

GiGL Automation

@ 23:09:35UTC : 🔄 E2E Test started.

@ 24:35:00UTC : ❌ Workflow failed.
Please check the logs for more details.

[github-actions]

GiGL Automation

@ 23:09:37UTC : 🔄 C++ Unit Test started.

@ 23:18:13UTC : ✅ Workflow completed successfully.

[github-actions]

GiGL Automation

@ 23:09:38UTC : 🔄 Integration Test started.

@ 24:20:42UTC : ✅ Workflow completed successfully.

[semgrep-code-snapchat]

Semgrep identified an issue in your code:

The subprocess.run() call uses shell=True on user-controlled command strings, allowing shell injection attacks that could execute arbitrary commands with the process's privileges.

More details about this

The subprocess.run() call executes shell_line with shell=True, which spawns a shell process to interpret the command. This is dangerous because if resolved_command or any element in resolved_args comes from untrusted input (e.g., user-provided configuration, external data), an attacker can inject arbitrary shell commands.

For example, if an attacker controls custom_resource_config.command and sets it to id; rm -rf /, the shell will execute both id and the destructive rm -rf / command. Even though shlex.quote() escapes individual arguments, it doesn't protect against injection in the command itself—only in the args list. An attacker who controls the command field can bypass this protection entirely.

Exploit scenario:

1. Attacker provides custom_resource_config.command = "echo test; cat /etc/passwd #"
2. After joining with args, shell_line becomes something like "echo test; cat /etc/passwd #"
3. When subprocess.run() executes this with shell=True, the shell interprets the semicolon as a command separator
4. Both echo test and cat /etc/passwd execute, leaking sensitive system files
5. If the process runs with elevated privileges, the attacker can exfiltrate or modify sensitive data

The shell inherits environment variables and settings from the parent process, which further expands the attack surface. Using shell=False would treat the entire string as a single command name rather than allowing shell metacharacters to be interpreted.

To resolve this comment:

💡 Follow autofix suggestion

Suggested change

	subprocess.run(shell_line, shell=True, check=True)
	subprocess.run(shell_line, shell=False, check=True)

View step-by-step instructions

1. Replace subprocess.run(shell_line, shell=True, check=True) with an invocation that does not use shell=True.
2. Change the code to directly pass the command and arguments as a list, rather than joining into a string. Use: subprocess.run([resolved_command] + resolved_args, check=True).
3. Remove any uses of shlex.quote when building the argument list, since quoting is only necessary when passing a string to the shell.
4. Ensure that resolved_command and every item in resolved_args are unquoted strings representing the command and its arguments.

Passing the command and arguments as a list with shell=False (the default) is safer, because it avoids any interpretation by a shell, preventing command injection vulnerabilities.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by subprocess-shell-true.

_{You can view more details about this finding in the Semgrep AppSec Platform.}