{"version":"1.181.0","results":[{"check_id":"Users.dave..codex.worktrees.9f01.dataflowbench.execution-state.v092.groups.series-01.semgrep-python-native.attempt-01.adapters.semgrep.native.v0.9.2.python.rules.audit.dangerous-system-call-audit","path":"/Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/groups/series-01/semgrep-python-native/attempt-01/tmp/dataflowbench-native-semgrep-python/dfb-taint-python-native-propagator-positive/source/join_command.py","start":{"line":15,"col":5,"offset":443},"end":{"line":15,"col":22,"offset":460},"extra":{"message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.","metadata":{"source-rule-url":"https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html","cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://semgrep.dev/docs/cheat-sheets/python-command-injection/"],"asvs":{"control_id":"5.2.4 Dyanmic Code Execution Features","control_url":"https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements","section":"V5: Validation, Sanitization and Encoding Verification Requirements","version":"4"},"category":"security","technology":["python"],"confidence":"LOW","cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH"},"severity":"ERROR","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"Users.dave..codex.worktrees.9f01.dataflowbench.execution-state.v092.groups.series-01.semgrep-python-native.attempt-01.adapters.semgrep.native.v0.9.2.python.rules.audit.dangerous-system-call-tainted-env-args","path":"/Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/groups/series-01/semgrep-python-native/attempt-01/tmp/dataflowbench-native-semgrep-python/dfb-taint-python-native-propagator-positive/source/join_command.py","start":{"line":15,"col":5,"offset":443},"end":{"line":15,"col":22,"offset":460},"extra":{"message":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.","metadata":{"source-rule-url":"https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html","cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://semgrep.dev/docs/cheat-sheets/python-command-injection/"],"asvs":{"control_id":"5.2.4 Dyanmic Code Execution Features","control_url":"https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements","section":"V5: Validation, Sanitization and Encoding Verification Requirements","version":"4"},"category":"security","technology":["python"],"confidence":"MEDIUM","cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH"},"severity":"ERROR","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}}],"errors":[],"paths":{"scanned":["/Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/groups/series-01/semgrep-python-native/attempt-01/tmp/dataflowbench-native-semgrep-python/dfb-taint-python-native-propagator-positive/source/join_command.py"]},"time":{"rules":[],"rules_parse_time":0.012408971786499023,"profiling_times":{"config_time":1.6374011039733887,"core_time":21.050039052963257,"ignores_time":8.702278137207031e-05,"total_time":22.691208124160767},"parsing_time":{"total_time":0.0032629966735839844,"per_file_time":{"mean":0.0010876655578613281,"std_dev":2.3660327315155882e-06},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.0074388980865478516,"per_file_time":{"mean":0.0074388980865478516,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.002518892288208008,"per_file_and_rule_time":{"mean":0.0008396307627360026,"std_dev":1.330640025622011e-06},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0004911422729492188,"per_def_and_rule_time":{"mean":0.0002455711364746094,"std_dev":4.948157084072591e-08},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":0.031914893617021274,"rules_matched_ratio":0.031914893617021274},"targets":[],"total_bytes":0,"max_memory_bytes":143237248},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]}