mcp-server-semgrep/semgrep-rules/python/lang/security/audit/dangerous-testcapi-run-in-subinterp-audit.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: dangerous-testcapi-run-in-subinterp-audit
  patterns:
  - pattern-either:
    - pattern: |
        _testcapi.run_in_subinterp($PAYLOAD, ...)
    - pattern: |
        test.support.run_in_subinterp($PAYLOAD, ...)
  - pattern-not: |
      _testcapi.run_in_subinterp("...", ...)
  - pattern-not: |
      test.support.run_in_subinterp("...", ...)
  message: >-
    Found dynamic content in `run_in_subinterp`.
    This is dangerous if external data can reach this function call because it allows
    a malicious actor to run arbitrary Python code.
    Ensure no external data reaches here.
  metadata:
    cwe:
    - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
    owasp:
    - A03:2021 - Injection
    references:
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    category: security
    technology:
    - python
    confidence: LOW
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
  severity: WARNING
  languages:
  - python