{"version":"1.181.0","results":[{"check_id":"Users.dave..codex.worktrees.9f01.dataflowbench.execution-state.v092.groups.series-01.semgrep-python-native.attempt-01.adapters.semgrep.native.v0.9.2.python.rules.audit.dangerous-system-call-audit","path":"/Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/groups/series-01/semgrep-python-native/attempt-01/tmp/dataflowbench-native-semgrep-python/dfb-taint-python-native-sanitizer-negative/source/quote_command.py","start":{"line":18,"col":5,"offset":674},"end":{"line":18,"col":32,"offset":701},"extra":{"message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.","metadata":{"source-rule-url":"https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html","cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://semgrep.dev/docs/cheat-sheets/python-command-injection/"],"asvs":{"control_id":"5.2.4 Dyanmic Code Execution Features","control_url":"https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements","section":"V5: Validation, Sanitization and Encoding Verification Requirements","version":"4"},"category":"security","technology":["python"],"confidence":"LOW","cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH"},"severity":"ERROR","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"Users.dave..codex.worktrees.9f01.dataflowbench.execution-state.v092.groups.series-01.semgrep-python-native.attempt-01.adapters.semgrep.native.v0.9.2.python.rules.audit.dangerous-system-call-tainted-env-args","path":"/Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/groups/series-01/semgrep-python-native/attempt-01/tmp/dataflowbench-native-semgrep-python/dfb-taint-python-native-sanitizer-negative/source/quote_command.py","start":{"line":18,"col":5,"offset":674},"end":{"line":18,"col":32,"offset":701},"extra":{"message":"Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.","metadata":{"source-rule-url":"https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html","cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://semgrep.dev/docs/cheat-sheets/python-command-injection/"],"asvs":{"control_id":"5.2.4 Dyanmic Code Execution Features","control_url":"https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements","section":"V5: Validation, Sanitization and Encoding Verification Requirements","version":"4"},"category":"security","technology":["python"],"confidence":"MEDIUM","cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH"},"severity":"ERROR","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}}],"errors":[],"paths":{"scanned":["/Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/groups/series-01/semgrep-python-native/attempt-01/tmp/dataflowbench-native-semgrep-python/dfb-taint-python-native-sanitizer-negative/source/quote_command.py"]},"time":{"rules":[],"rules_parse_time":0.01235198974609375,"profiling_times":{"config_time":1.575334072113037,"core_time":20.73098397254944,"ignores_time":8.511543273925781e-05,"total_time":22.309888124465942},"parsing_time":{"total_time":0.0032210350036621094,"per_file_time":{"mean":0.0010736783345540366,"std_dev":2.305570332181459e-06},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.00764012336730957,"per_file_time":{"mean":0.00764012336730957,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.002566099166870117,"per_file_and_rule_time":{"mean":0.0008553663889567057,"std_dev":1.375754979764881e-06},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.0002079010009765625,"per_def_and_rule_time":{"mean":0.00010395050048828125,"std_dev":6.883965397719294e-09},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":0.031914893617021274,"rules_matched_ratio":0.031914893617021274},"targets":[],"total_bytes":0,"max_memory_bytes":147693696},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]}