Description

While reviewing the repository's static analysis engine, I found that Python shell invocation APIs using shell=True are currently not detected.

The project already includes security rules for:

• eval()
• exec()
• hardcoded secrets
• XSS-related patterns
• prototype pollution

However, command execution through Python's subprocess module with shell=True is not covered.

Current Analysis

Security pattern detection is primarily implemented through:

• backend/app/services/code_assistant.py (BUG_PATTERNS)
• backend/app/services/ast_analyzer.py (PythonASTAnalyzer)

After reviewing both implementations:

• No rule exists for subprocess.run(..., shell=True)
• No rule exists for subprocess.Popen(..., shell=True)
• No rule exists for subprocess.call(..., shell=True)
• No rule exists for subprocess.check_output(..., shell=True)
• No rule exists for subprocess.check_call(..., shell=True)

The AST analyzer currently detects eval() and exec() calls but does not inspect subprocess invocations.

Reproduction Example

import subprocess

cmd = input()

subprocess.run(cmd, shell=True)

Expected Result

A security warning should be generated indicating a possible command injection risk.

Actual Result

No warning is produced.

Why This Matters

Using shell=True causes commands to be executed through the system shell.

When user-controlled input reaches these APIs, it may lead to command injection vulnerabilities.

This is a widely recognized Python security anti-pattern and is referenced in Python security guidance and OWASP recommendations.

Proposed Solution

Add a new security rule to BUG_PATTERNS for detecting subprocess invocations with shell=True.

Example coverage:

• subprocess.run(..., shell=True)
• subprocess.Popen(..., shell=True)
• subprocess.call(..., shell=True)
• subprocess.check_output(..., shell=True)
• subprocess.check_call(..., shell=True)

Suggested warning:

"shell=True may lead to command injection vulnerabilities. Prefer argument lists and avoid invoking the shell when possible."

Possible Implementation

Location:

backend/app/services/code_assistant.py

Example pattern:

BugPattern(
    "Subprocess Shell True",
    r"subprocess\.(run|call|Popen|check_output|check_call)\s*\([^)]*shell\s*=\s*True",
    "`shell=True` passes commands through the system shell and may lead to command injection.",
    "Use argument lists with shell=False whenever possible.",
    "error",
    ["Python"],
)

Additional Notes

Related command execution APIs such as:

• os.system()
• os.popen()

also appear to be uncovered and may be considered in future enhancements.

IM A GSSOC 2026 CONTRIBUTOR

Suggested Labels

• level:beginner
• type:security
• quality:exceptional

SCREENSHOTS Python AST analyzer currently checks eval() and exec() calls only.