{"version":"1.181.0","results":[{"check_id":"Users.dave..codex.worktrees.9f01.dataflowbench.execution-state.v092.groups.series-01.semgrep-python-native.attempt-01.adapters.semgrep.native.v0.9.2.python.rules.audit.dangerous-system-call-audit","path":"/Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/groups/series-01/semgrep-python-native/attempt-01/tmp/dataflowbench-native-semgrep-python/dfb-taint-python-native-propagator-negative/source/join_command.py","start":{"line":15,"col":5,"offset":451},"end":{"line":15,"col":22,"offset":468},"extra":{"message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.","metadata":{"source-rule-url":"https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html","cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://semgrep.dev/docs/cheat-sheets/python-command-injection/"],"asvs":{"control_id":"5.2.4 Dyanmic Code Execution Features","control_url":"https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements","section":"V5: Validation, Sanitization and Encoding Verification Requirements","version":"4"},"category":"security","technology":["python"],"confidence":"LOW","cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH"},"severity":"ERROR","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}}],"errors":[],"paths":{"scanned":["/Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/groups/series-01/semgrep-python-native/attempt-01/tmp/dataflowbench-native-semgrep-python/dfb-taint-python-native-propagator-negative/source/join_command.py"]},"time":{"rules":[],"rules_parse_time":0.013054847717285156,"profiling_times":{"config_time":1.814352035522461,"core_time":22.341919898986816,"ignores_time":9.489059448242188e-05,"total_time":24.160109996795654},"parsing_time":{"total_time":0.004950046539306641,"per_file_time":{"mean":0.0016500155131022136,"std_dev":5.445102386955922e-06},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.00963902473449707,"per_file_time":{"mean":0.00963902473449707,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.002691030502319336,"per_file_and_rule_time":{"mean":0.0008970101674397787,"std_dev":1.5049536664769728e-06},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0006272792816162109,"per_def_and_rule_time":{"mean":0.00031363964080810547,"std_dev":8.439782561708853e-08},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":0.031914893617021274,"rules_matched_ratio":0.031914893617021274},"targets":[],"total_bytes":0,"max_memory_bytes":144851456},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]}