command-injection: a PowerShell script named like -Command after -File is read as the option #218

Problem

After -File, a script whose constant name is spelled like a PowerShell rest option is read as that option, and the elements after it as the command.

subprocess.run(["pwsh", "-File", "-c", f"v{x}"])        # reported high, vulnerability
subprocess.run(["powershell", "-File", "-Command", f"v{x}"])  # reported high, vulnerability

PowerShell takes the element after -File as the file name, so f"v{x}" is an argument of a script named -c and should be refuted, as ["pwsh", "-File", "s.ps1", f"v{x}"] is.

Found in review of #217 (head 9106b17); a false positive, never a missed finding.

Cause

command_injection.py, _Command.after_code: the loop that hands elements after a rest option to the rest reading scans positions 1..given inclusive. When the code option is -File, position given holds its value (the script path), not an option.

Expected

Scan range(1, given): the code option itself is still scanned (for an option taking a value, given is its position plus one), its value is not. Regression tests for the two calls above, with the constant script names -c, -e, -ec and -Command.