{"version":"1.181.0","results":[{"check_id":"Users.dave..codex.worktrees.9f01.dataflowbench.execution-state.v092.groups.series-01.semgrep-python-native.attempt-01.adapters.semgrep.native.v0.9.2.python.rules.audit.dangerous-system-call-audit","path":"/Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/groups/series-01/semgrep-python-native/attempt-01/tmp/dataflowbench-native-semgrep-python/dfb-taint-python-native-summary-negative/source/roundtrip_command.py","start":{"line":15,"col":5,"offset":405},"end":{"line":15,"col":23,"offset":423},"extra":{"message":"Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.","metadata":{"source-rule-url":"https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html","cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection","A05:2025 - Injection"],"references":["https://semgrep.dev/docs/cheat-sheets/python-command-injection/"],"asvs":{"control_id":"5.2.4 Dyanmic Code Execution Features","control_url":"https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements","section":"V5: Validation, Sanitization and Encoding Verification Requirements","version":"4"},"category":"security","technology":["python"],"confidence":"LOW","cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH"},"severity":"ERROR","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}}],"errors":[],"paths":{"scanned":["/Users/dave/.codex/worktrees/9f01/dataflowbench/execution-state/v092/groups/series-01/semgrep-python-native/attempt-01/tmp/dataflowbench-native-semgrep-python/dfb-taint-python-native-summary-negative/source/roundtrip_command.py"]},"time":{"rules":[],"rules_parse_time":0.013105154037475586,"profiling_times":{"config_time":1.5806889533996582,"core_time":21.16510009765625,"ignores_time":8.7738037109375e-05,"total_time":22.749602794647217},"parsing_time":{"total_time":0.004439115524291992,"per_file_time":{"mean":0.0014797051747639973,"std_dev":4.379054808446704e-06},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":0.007524013519287109,"per_file_time":{"mean":0.007524013519287109,"std_dev":0.0},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.0017328262329101562,"per_file_and_rule_time":{"mean":0.0005776087443033855,"std_dev":5.720614555886843e-07},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.00021314620971679688,"per_def_and_rule_time":{"mean":0.00010657310485839844,"std_dev":7.123389877961017e-09},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_defs":[]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":1.0,"rules_selected_ratio":0.031914893617021274,"rules_matched_ratio":0.031914893617021274},"targets":[],"total_bytes":0,"max_memory_bytes":147202368},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]}