semgrep subprocess shell false codemod

src/codemodder/scripts/generate_docs.py

@@ -325,6 +325,7 @@ class DocMetadata:
 SEMGREP_CODEMOD_NAMES = [
     "enable-jinja2-autoescape",
     "jwt-decode-verify",
+    "subprocess-shell-false",
 ]
 SEMGREP_CODEMODS = {
     name: DocMetadata(

src/core_codemods/__init__.py

@@ -56,6 +56,7 @@
 from .secure_random import SecureRandom
 from .semgrep.semgrep_enable_jinja2_autoescape import SemgrepEnableJinja2Autoescape
 from .semgrep.semgrep_jwt_decode_verify import SemgrepJwtDecodeVerify
+from .semgrep.semgrep_subprocess_shell_false import SemgrepSubprocessShellFalse
 from .sonar.sonar_break_or_continue_out_of_loop import SonarBreakOrContinueOutOfLoop
 from .sonar.sonar_disable_graphql_introspection import SonarDisableGraphQLIntrospection
 from .sonar.sonar_django_json_response_type import SonarDjangoJsonResponseType
@@ -200,5 +201,6 @@
     codemods=[
         SemgrepEnableJinja2Autoescape,
         SemgrepJwtDecodeVerify,
+        SemgrepSubprocessShellFalse,
     ],
 )

src/core_codemods/semgrep/semgrep_subprocess_shell_false.py

@@ -0,0 +1,9 @@
+from core_codemods.semgrep.api import SemgrepCodemod
+from core_codemods.subprocess_shell_false import SubprocessShellFalse
+
+SemgrepSubprocessShellFalse = SemgrepCodemod.from_core_codemod(
+    name="subprocess-shell-false",
+    other=SubprocessShellFalse,
+    rule_id="python.lang.security.audit.subprocess-shell-true.subprocess-shell-true",
+    rule_name="subprocess-shell-true",
+)

tests/codemods/semgrep/test_semgrep_subprocess_shell_false.py

@@ -0,0 +1,66 @@
+import json
+
+from codemodder.codemods.test import BaseSASTCodemodTest
+from core_codemods.semgrep.semgrep_subprocess_shell_false import (
+    SemgrepSubprocessShellFalse,
+)
+
+
+class TestSemgrepSubprocessShellFalse(BaseSASTCodemodTest):
+    codemod = SemgrepSubprocessShellFalse
+    tool = "semgrep"
+
+    def test_name(self):
+        assert self.codemod.name == "subprocess-shell-false"
+
+    def test_import(self, tmpdir):
+        input_code = """\
+        from subprocess import run
+        run(args, shell=True)
+        """
+        expexted_output = """\
+        from subprocess import run
+        run(args, shell=False)
+        """
+
+        results = {
+            "runs": [
+                {
+                    "results": [
+                        {
+                            "fingerprints": {"matchBasedId/v1": "123"},
+                            "locations": [
+                                {
+                                    "physicalLocation": {
+                                        "artifactLocation": {
+                                            "uri": "code.py",
+                                            "uriBaseId": "%SRCROOT%",
+                                        },
+                                        "region": {
+                                            "endColumn": 22,
+                                            "endLine": 2,
+                                            "snippet": {
+                                                "text": "run(args, shell=True)"
+                                            },
+                                            "startColumn": 1,
+                                            "startLine": 2,
+                                        },
+                                    }
+                                }
+                            ],
+                            "message": {
+                                "text": "Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead."
+                            },
+                            "properties": {},
+                            "ruleId": "python.lang.security.audit.subprocess-shell-true.subprocess-shell-true",
+                        }
+                    ]
+                }
+            ]
+        }
+        self.run_and_assert(
+            tmpdir,
+            input_code,
+            expexted_output,
+            results=json.dumps(results),
+        )