mcp-server-semgrep/semgrep-rules/python/django/security/injection/command/subprocess-injection.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: subprocess-injection
  languages: [python]
  mode: taint
  options:
    symbolic_propagation: true
  pattern-sources:
  - patterns:
    - pattern-inside: |
        def $FUNC(..., $REQUEST, ...):
          ...
    - focus-metavariable: $REQUEST
    - metavariable-pattern:
        metavariable: $REQUEST
        patterns:
        - pattern: request
        - pattern-not-inside: request.build_absolute_uri
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: subprocess.$FUNC(...)
        - pattern-not: subprocess.$FUNC("...", ...)
        - pattern-not: subprocess.$FUNC(["...", ...], ...)
        - pattern-not-inside: |
            $CMD = ["...", ...]
            ...
            subprocess.$FUNC($CMD, ...)
      - patterns:
        - pattern: subprocess.$FUNC(["$SHELL", "-c", ...], ...)
        - metavariable-regex:
            metavariable: $SHELL
            regex: ^(sh|bash|ksh|csh|tcsh|zsh)$
      - patterns:
        - pattern: subprocess.$FUNC(["$INTERPRETER", ...], ...)
        - metavariable-regex:
            metavariable: $INTERPRETER
            regex: ^(python|python\d)$
  pattern-sanitizers:
  - patterns:
    - pattern: $DICT[$KEY]
    - focus-metavariable: $KEY
  severity: ERROR
  message: >-
    Detected user input entering a `subprocess` call unsafely. This could
    result in a command injection vulnerability. An attacker could use this
    vulnerability to execute arbitrary commands on the host, which allows
    them to download malware, scan sensitive data, or run any command they
    wish on the server. Do not let users choose the command to run. In general,
    prefer to use Python API versions of system commands. If you must use subprocess,
    use a dictionary to allowlist a set of commands.
  metadata:
    category: security
    technology:
    - flask
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    cwe:
    - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
    references:
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    confidence: HIGH
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH