add jsonpickle and pexpect libs in case of unsafe decoding and secondary command execution, add proper test cases

python/ql/test/experimental/query-tests/Security/CWE-074-SecondaryServerCmdInjection/Pexpect.py

@@ -0,0 +1,21 @@
+#!/usr/bin/env python
+
+from fastapi import FastAPI
+from pexpect import pxssh
+
+ssh = pxssh.pxssh()
+hostname = "localhost"
+username = "username"
+password = "password"
+ssh.login(hostname, username, password)
+
+app = FastAPI()
+
+@app.get("/bad1")
+async def bad1(cmd: str):
+    ssh.send(cmd)  # $ result=BAD getSecondaryCommand=cmd
+    ssh.prompt()
+    ssh.sendline(cmd)  # $ result=BAD getSecondaryCommand=cmd
+    ssh.prompt()
+    ssh.logout()
+    return {"success": stdout}