Clarification: V1.2.5 "Parameterized OS queries"

Verify that the application protects against OS command injection and that operating system calls use parameterized OS queries or use contextual command line output encoding.

The term "Parameterized OS queries" is somewhat non-standard and can be considered misleading for several reasons:

• The term "Parameterized OS queries" is not commonly used in security or programming. In contrast, terms like "parameterized command execution", "safe API usage", or "argument separation" are more widely used when discussing OS command injection prevention.
• The word "queries" suggests a structured request to a system, like querying a database or API. OS commands, however, are typically imperative instructions (e.g., ping, ls, rm) rather than queries retrieving data. This can mislead developers into thinking the requirement involves a database-like query mechanism, which is not applicable.
• The term doesn’t clearly convey the best practice of using safe APIs, that separate commands from user input.
• There is no universal, platform-agnostic standard for escaping shell arguments that guarantees safety across all operating systems. It’s dangerous if misused.

Output encoding for shell is not as robust or standardized as HTML/JS encoding. So relying on encoding here is dangerous — it’s not practical or testable guidance unless a specific, reliable escaping function is provided.

Please improve clarity and standardization of the terms to improve developer understanding to reduce the ambiguity.