ALL-SECU0005 · evidence
This page continues ALL-SECU0005 directly from its source docstring. Read its implementation.
Evidence
Section titled “Evidence”Each finding names the declaration, the launcher, and the line. The value is how many launches
reach a shell. A launcher the source writes with a receiver has to match the whole callee, so
os.system counts while platform.system only reads a machine name and stays out, and
System.out never arrives at all. A launcher written on its own matches on its bare name,
which is how C and PHP spell system.
Exceptions
Section titled “Exceptions”A launcher that says it does not want a shell, such as one written with shell=False, is left
alone, and so is one handed an argument list, because a list is the shape this rule asks for.
A launcher handed one constant command line has nothing an attacker can reach, so only a shell
asked for by name and a command line built from parts are reported. An argument combining two
values that names no part of a command, the way exec_tag::sync | exec_tag::timer does, is
not a command line and is left alone. A project that wraps its own name around a shell names
that wrapper through also_through_a_shell, which is read from the last segment of the callee
so that a method on a house object is found wherever it hangs.
References
Section titled “References”- Generalizes Ruff S602 subprocess-popen-with-shell-equals-true. Open reference
- Generalizes Ruff S604 call-with-shell-equals-true. Open reference
- Generalizes Ruff S605 start-process-with-a-shell. Open reference
- Cites “Common Weakness Enumeration”, CWE-78, improper neutralization in an OS command. Open reference