Detect /bin/bash -c "end-run" around Shell=True checking
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 835
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Is your feature request related to a problem? Please describe.
Bandit successfully finds use of Shell=True in subprocess (and other) methods.
But of course, Shell=False can be defeated by providing one's command wrapped in bash -c "".
Describe the solution you'd like
Bandit should check for the use of shells in the same class of commands.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing Bandit's existing Shell=True check and the related subprocess analysis entry points. Determine how commands wrapped with bash -c are represented, then add detection for the requested shell usage and verify that it covers the same class of commands without false positives. The issue does not name specific files or tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- bash, python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100