mirror of
https://github.com/github/codeql.git
synced 2026-04-12 18:44:00 +02:00
Update the CommandInjection query to only consider sinks where the argument is interpreted by a shell. If the argument is passed directly to a subprocess then it's not vulnerable to shell injection.