ALL-SECU0005 · command_built_from_a_shell_string
Count the process launches that hand a command line to a shell.
This is a deterministic rule for all languages. Read its implementation.
Definition
Section titled “Definition”Report a spawn that runs through a shell rather than through an argument list. A shell reads
the string it receives and treats a space, a quote, a backtick, and a statement separator as
syntax, so any value that reaches that string can append a second command the caller never
wrote. Handing the launcher a list keeps every argument separate no matter what it holds,
which is why the list form is the repair rather than another round of escaping. One rule
answers for os.system, shell_exec, child_process.exec, and a command asked for sh -c.
A command line built from parts is one whose first argument combines values and states part of the command itself. The operator alone does not say what it joined, so a piece of the command has to be written down inside the expression. Without that, two flags combined with a bitwise or read as an assembled command line in every brace language.
Continue with evidence and references, or open the examples.