hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

python: Inline expectation should have space after $

Browse Source 
This was a regex-find-replace from `# \$(?! )` (using a negative lookahead) to `# $ `.
This commit is contained in:
Owen Mansel-Chan
2026-03-04 11:42:07 +00:00
parent 0eccd902c2
commit 5a97348e78
61 changed files with 784 additions and 785 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
python/ql/test/query-tests/Security/CWE-078-UnsafeShellCommandConstruction/src/unsafe_shell_test.py
View File

@@ -2,52 +2,52 @@ import os
import subprocess
def unsafe_shell_one(name):
os.system("ping " + name) # $result=BAD
os.system("ping " + name) # $ result=BAD
# f-strings
os.system(f"ping {name}") # $result=BAD
os.system(f"ping {name}") # $ result=BAD
# array.join
os.system("ping " + " ".join(name)) # $result=BAD
os.system("ping " + " ".join(name)) # $ result=BAD
# array.join, with a list
os.system("ping " + " ".join([name])) # $result=BAD
os.system("ping " + " ".join([name])) # $ result=BAD
# format, using .format
os.system("ping {}".format(name)) # $result=BAD
os.system("ping {}".format(name)) # $ result=BAD
# format, using %
os.system("ping %s" % name) # $result=BAD
os.system("ping %s" % name) # $ result=BAD
os.system(name) # OK - seems intentional.
import fabric
def facbric_stuff (name):
def facbric_stuff (name):
fabric.api.run("ping " + name, shell=False) # OK
fabric.api.run("ping " + name, shell=True) # $result=BAD
fabric.api.run("ping " + name, shell=True) # $ result=BAD
def indirect(flag):
def indirect(flag):
fabric.api.run("ping " + name, shell=flag) # OK
indirect(False)
def subprocess_flag (name):
def subprocess_flag (name):
subprocess.run("ping " + name, shell=False) # OK - and nonsensical
subprocess.run("ping " + name, shell=True) # $result=BAD
subprocess.run("ping " + name, shell=True) # $ result=BAD
def indirect(flag, x):
subprocess.run("ping " + x, shell=flag) # $result=BAD
def indirect(flag, x):
subprocess.run("ping " + x, shell=flag) # $ result=BAD
indirect(True, name)
subprocess.Popen("ping " + name, shell=unknownValue) # OK - shell assumed to be False
def intentional(command):
os.system("fish -ic " + command) # $result=OK - intentional
def intentional(command):
os.system("fish -ic " + command) # $ result=OK - intentional
import shlex
def unsafe_shell_sanitized(name):
os.system("ping " + shlex.quote(name)) # $result=OK - sanitized
def unsafe_shell_sanitized(name):
os.system("ping " + shlex.quote(name)) # $ result=OK - sanitized