fix: remove shell injection vulnerabilities in hdfs_utils.py

[fwh888]

Summary

This PR fixes three shell injection vulnerabilities in rdsa_utils/cdp/helpers/hdfs_utils.py identified during a code audit of the CDP module (see issue #246).

Vulnerabilities Fixed

1. create_txt_from_string() — shell injection via string_to_write and path

Before:

subprocess.call([f'echo "{string_to_write}" | hadoop fs -put - {path}'], shell=True)

After: Uses stdin-based piping via subprocess.Popen:

proc = subprocess.Popen([hadoop, fs, -put, -, path], stdin=subprocess.PIPE, ...)
proc.communicate(input=string_to_write.encode("utf-8"), timeout=15)

2. get_date_modified() — shell injection via filepath

Before:

subprocess.Popen(f"hadoop fs -stat %y {filepath}", shell=True)

After: List-based command:

subprocess.Popen(["hadoop", "fs", "-stat", "%y", filepath], ...)

3. read_dir_files_recursive() — shell injection via path

Before: Shell pipeline with grep/tr/cut:

subprocess.Popen(f"hadoop fs -ls -R {path} | grep -v ^d | tr -s ' ' | cut -d ' ' -f 8-", shell=True)

After: Pure Python parsing of hadoop fs -ls -R output.

Testing

• All 20 existing tests pass (verified locally)
• Tests updated to verify list-based commands instead of shell=True
• Added test case for read_dir_files_recursive output parsing

[coatet]

Closed, as we do not accept submissions from users outside the ONS and I suspect this may be an LLM.