command-injection: decide on a distinct argument-injection rule for option cases #220

Decision to take

#208 (merged in #217) reports option injection, an attacker-controlled element of an argument list run without a shell, under the rule id command-injection and the message title Command injection, with the case in the evidence (…the input is a whole element, so it may be read as an option). The issue left the naming to a later decision.

Options:

• A distinct rule argument-injection for the option cases (4, 5b, 5c, 7 of command-injection: severity of option injection in argument lists run without a shell #208), command-injection keeping the shell, program, operand-command and interpreter cases. Clearer for users and for suppressions and baselines, but a new rule id: existing suppressions and baselines of those findings would no longer match, and the SARIF rule catalogue grows.
• Keep command-injection with a distinct message title (Option injection) and a metadata field (injection: option | command). No change to rule ids, suppressions or baselines; filtering needs the metadata.

To settle

Which option, and for the first: the rule's default severity, its SARIF description, and whether a release note announces the split for existing suppressions and baselines.