Improve shell

bandit/plugins/injection_shell.py

@@ -85,6 +85,25 @@ def gen_config(name):
             }
 
 
+def has_shell(context):
+    keywords = context.node.keywords
+    if 'shell' in context.call_keywords:
+        for key in keywords:
+            if key.arg == 'shell':
+                val = key.value
+                if isinstance(val, ast.Num):
+                    return bool(val.n)
+                if isinstance(val, ast.List):
+                    return bool(val.elts)
+                if isinstance(val, ast.Dict):
+                    return bool(val.keys)
+                if isinstance(val, ast.Name):
+                    if val.id in ['False', 'None']:
+                        return False
+                return True
+    return False
+
+
 @test.takes_config('shell_injection')
 @test.checks('Call')
 @test.test_id('B602')
@@ -180,7 +199,7 @@ def subprocess_popen_with_shell_equals_true(context, config):
     .. versionadded:: 0.9.0
     """
     if config and context.call_function_name_qual in config['subprocess']:
-        if context.check_call_arg_value('shell', 'True'):
+        if has_shell(context):
             if len(context.call_args) > 0:
                 sev = _evaluate_shell_call(context)
                 if sev == bandit.LOW:
@@ -271,7 +290,7 @@ def subprocess_without_shell_equals_true(context, config):
     .. versionadded:: 0.9.0
     """
     if config and context.call_function_name_qual in config['subprocess']:
-        if not context.check_call_arg_value('shell', 'True'):
+        if not has_shell(context):
             return bandit.Issue(
                 severity=bandit.LOW,
                 confidence=bandit.HIGH,
@@ -349,7 +368,7 @@ def any_other_function_with_shell_equals_true(context, config):
     .. versionadded:: 0.9.0
     """
     if config and context.call_function_name_qual not in config['subprocess']:
-        if context.check_call_arg_value('shell', 'True'):
+        if has_shell(context):
             return bandit.Issue(
                 severity=bandit.MEDIUM,
                 confidence=bandit.LOW,

examples/subprocess_shell.py

@@ -5,6 +5,9 @@
 def Popen(*args, **kwargs):
     print('hi')
 
+    def __len__(self):
+        return 0
+
 pop('/bin/gcc --version', shell=True)
 Popen('/bin/gcc --version', shell=True)
 
@@ -31,3 +34,21 @@ def Popen(*args, **kwargs):
 subprocess.Popen(command, shell=True)
 
 subprocess.Popen('/bin/ls && cat /etc/passwd', shell=True)
+
+# Issue #157
+command = 'pwd'
+subprocess.call(command, shell='True')
+subprocess.call(command, shell='False')
+subprocess.call(command, shell='None')
+subprocess.call(command, shell=1)
+
+subprocess.call(command, shell=Popen())
+subprocess.call(command, shell=[True])
+subprocess.call(command, shell={'IS': 'True'})
+subprocess.call(command, shell=command)
+
+subprocess.call(command, shell=False)
+subprocess.call(command, shell=0)
+subprocess.call(command, shell=[])
+subprocess.call(command, shell={})
+subprocess.call(command, shell=None)

tests/functional/test_functional.py

@@ -417,8 +417,8 @@ def test_ssl_insecure_version(self):
     def test_subprocess_shell(self):
         '''Test for `subprocess.Popen` with `shell=True`.'''
         expect = {
-            'SEVERITY': {'UNDEFINED': 0, 'LOW': 14, 'MEDIUM': 1, 'HIGH': 3},
-            'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 1, 'MEDIUM': 0, 'HIGH': 17}
+            'SEVERITY': {'UNDEFINED': 0, 'LOW': 19, 'MEDIUM': 1, 'HIGH': 11},
+            'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 1, 'MEDIUM': 0, 'HIGH': 30}
         }
         self.check_example('subprocess_shell.py', expect)