command-injection: severity of option injection in argument lists run without a shell #208

Problem

command-injection reports every tainted argument of subprocess.run, call, check_call, check_output and Popen identically (high severity, verdict: vulnerability), whether or not a shell interprets it and whatever the argument's position.

Observed on mitmproxy (engine 4365d6e): 8 high-severity findings in release/release.py and release/build.py, all list-form calls to a fixed executable (git, gh, xcrun) without a shell.

Reproduction

import subprocess
import sys

version = sys.argv[1]
subprocess.run(["git", "tag", f"v{version}"], check=True)               # reported: high, vulnerability
subprocess.run(["git", "commit", "-m", f"release {version}"], check=True)  # reported: high, vulnerability
subprocess.run(f"git tag v{version}", shell=True, check=True)          # reported: high, vulnerability (correct)

Root cause

bundled/models/python_stdlib/python_stdlib.py declares the subprocess functions as Sink(..., TaintKind.COMMAND) with no argument restriction, so every argument position is a command sink. Nothing in src/ reads the shell keyword.

Decided expectations

A list without a shell prevents shell interpretation, not option injection: an attacker-controlled element can still be read as an option (git push --receive-pack=<cmd>). What decides the result is what the attacker still controls in the final argument and whether a dangerous behaviour is established.

Severity rules

• high when the attacker controls the executable, a string interpreted by a shell, or an option whose dangerous behaviour is established (see Established dangerous options).
• medium by default for a controlled option (or option value) when the executable is fixed and no shell interprets the command.
• Severity is set explicitly for each case. The hotspot verdict is not used to lower severity: in the current code (plugins/detectors.py) it only lowers the confidence and keeps the rule's severity. Verdict and confidence express the strength of the evidence, never the severity.

Cases

"Free element" means an element whose whole value the attacker controls, so it may start with -.

Case 7 reading: "treated as case 4" means a controlled option value at case 4's severity; the unknown case keeps a finding whose evidence asks for review. To be confirmed in review of the implementation if this reading is wrong.

Established dangerous options

A dangerous behaviour is established only by model data, never inferred: an entry names the executable, optionally the subcommand, the option, and the documented behaviour (the option runs a command chosen by its value, or reads a configuration that does). Initial entries to review in the implementation:

• git: -c, --config-env (global); --upload-pack (clone, fetch, pull, ls-remote); --receive-pack, --exec (push).
• ssh: -o (ProxyCommand, LocalCommand).
• tar: --to-command, --checkpoint-action, --use-compress-program, -I.
• find: -exec, -execdir, -ok, -okdir.
• rsync: -e, --rsh.

Which options consume the following element (case 7) comes from the same model; without an entry, consumption is unknown.

Rule naming

To choose once the cases above are implemented: cases 1 to 3 remain command-injection; cases 4 to 7 are option injection and may become a distinct rule (argument-injection) or a distinct verdict of command-injection. The severities above apply either way.

Acceptance criteria

• Each case above, including 5b, 5c and both outcomes of case 7, is covered by a regression test that checks severity, verdict and confidence.
• Case 1 keeps its current result; cases 2, 3 and 8 are still reported as command injections at high.
• The effect on mitmproxy is measured, not assumed: a new scan at commit be75825 with the same configuration (enterprise plugins at ac35460, [email protected], no baseline) is compared with the 87 results of the 2026-10-02 report. For instance release.py:132 passes branch, a bare value read from git, to git push: with the git push entries above it stays high even though git refuses branch names starting with -, which the engine cannot know. build.py:178 and :200 pass values after --keychain, --team-id, --apple-id and --password of xcrun notarytool, which no model entry describes: they stay as findings to review (case 7).