Subprocess improvements

[akx]

• Use lists wherever possible (augments Security3 #10944)
• Deduplicate curl-calling code
• Avoid calling eval() on gsutil output

🛠️ PR Summary

_{Made with ❤️ by Ultralytics Actions}

🌟 Summary

Refactoring subprocess calls in the Ultralytics YOLOv5 repository for better security and performance.

📊 Key Changes

• Replaced subprocess command strings with lists to improve code security against shell injection attacks.
• Modified subprocess shell parameter usage for better practices.
• Added a new function curl_download in utils/downloads.py to handle curl downloads with retry support.
• Cleaned up and simplified code for calling external commands via subprocess to ensure consistency.

🎯 Purpose & Impact

• 🛡️ Enhancing Security: Use of subprocess lists over strings prevents shell injection vulnerabilities.
• 💡 Maintaining Clarity: Codebase becomes clearer and more maintainable with a standard approach for subprocess calls.
• 🔄 Improving Reliability: Implementation of the curl_download function with retry logic ensures more robust file downloads.
• 🔧 Streamlining Operations: These improvements lead to a more efficient development process and potentially fewer errors during model training, export, and validation scripts, benefiting developers and users by providing a more stable tool.

[glenn-jocher]

@akx thanks for the PR! I've been working on security improvements here and at https://github.com/ultralytics/ultralytics using Snyk. This repo in particular shows a lot of code injection vulnerabilities, but it's been hard to reduce them.

[glenn-jocher]

@akx new results look much better! All high severity issues are gone now :)

Most of the remaining medium severity ones are path traversals, i.e.: