contrib.dlint.dlint-equivalent.insecure-subprocess-use

rules:
  - id: insecure-subprocess-use
    message: The Python 'subprocess' module called with 'shell=True' may allow for
      shell injection
    languages:
      - python
    severity: WARNING
    metadata:
      source_rule_url: https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO116.md
      category: security
      technology:
        - python
      references:
        - https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO116.md
      owasp:
        - A09:2017 - Using Components with Known Vulnerabilities
        - A06:2021 - Vulnerable and Outdated Components
      cwe:
        - "CWE-95: Improper Neutralization of Directives in Dynamically
          Evaluated Code ('Eval Injection')"
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    pattern-either:
      - patterns:
          - pattern: subprocess.call(..., shell=True, ...)
          - pattern: subprocess.call('...', ..., shell=True, ...)
      - patterns:
          - pattern: subprocess.check_call(..., shell=True, ...)
          - pattern: subprocess.check_call('...', ..., shell=True, ...)
      - patterns:
          - pattern: subprocess.check_output(..., shell=True, ...)
          - pattern: subprocess.check_output('...', ..., shell=True, ...)
      - patterns:
          - pattern: subprocess.Popen(..., shell=True, ...)
          - pattern: subprocess.Popen('...', ..., shell=True, ...)
      - patterns:
          - pattern: subprocess.run(..., shell=True, ...)
          - pattern: subprocess.run('...', ..., shell=True, ...)