🛡️ Sentinel: [MEDIUM] Fix missing subprocess timeout in check_test_framework

.jules/sentinel.md

@@ -67,3 +67,8 @@
 **Vulnerability:** External CLI executions (`subprocess.run`) in hook scripts like `check_cross_functional_review.py` did not explicitly define a `timeout`, risking unbounded hangs and DoS if the external command stalls.
 **Learning:** `subprocess.run` by default has no timeout, making scripts vulnerable to infinite waits.
 **Prevention:** Always explicitly define a `timeout` argument (e.g., `timeout=15`) in `subprocess.run` and catch `subprocess.TimeoutExpired` to fail securely.
+
+## 2024-10-29 - [Missing Subprocess Timeout in check_test_framework.py]
+**Vulnerability:** External CLI executions (`subprocess.run`) in `scripts/hooks/check_test_framework.py` did not explicitly define a `timeout`, risking unbounded hangs and DoS if the external command stalls.
+**Learning:** `subprocess.run` by default has no timeout, making scripts vulnerable to infinite waits.
+**Prevention:** Always explicitly define a `timeout` argument (e.g., `timeout=15`) in `subprocess.run` and catch `subprocess.TimeoutExpired` to fail securely.

scripts/hooks/check_test_framework.py

@@ -41,13 +41,17 @@ class StagedTestPath:
 
 
 def _run_git(*args: str) -> tuple[int, str, str]:
-    result = subprocess.run(
-        ["git", *args],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    return result.returncode, result.stdout, redact_stderr(result.stderr or "")
+    try:
+        result = subprocess.run(
+            ["git", *args],
+            capture_output=True,
+            text=True,
+            check=False,
+            timeout=15,
+        )
+        return result.returncode, result.stdout, redact_stderr(result.stderr or "")
+    except subprocess.TimeoutExpired:
+        return 1, "", "git command timed out"
 
 
 def _normalize_path(path: str) -> str: