S4036 Searching OS commands in PATH is security-sensitive

[eric-therond-sonarsource]

Implements RSPEC-4036 part of MMF-2106

For both JS/TS

Code examples: https://github.com/SonarSource/security-expected-issues/tree/master/javascript/rules/hotspots/RSPEC-4036

Report on exec*/spawn*:

const cp = require('child_process');

cp.exec('file.exe'); // Sensitive
cp.execSync('file.exe'); // Sensitive
cp.spawn('file.exe'); // Sensitive
cp.spawnSync('file.exe'); // Sensitive
cp.execFile('file.exe'); // Sensitive
cp.execFileSync('file.exe'); // Sensitive

cp.exec('/usr/bin/file.exe'); // Compliant
cp.execSync('/usr/bin/file.exe'); // Compliant
cp.spawn('/usr/bin/file.exe'); // Compliant
cp.spawnSync('/usr/bin/file.exe'); // Compliant
cp.execFile('/usr/bin/file.exe'); // Compliant
cp.execFileSync('/usr/bin/file.exe'); // Compliant

when the first arg is not an absolute path or relative path (ie: the PATH environment variable is used to search the binary).

A check could be to look for the first chars of the string, if different from:

• ./
• .\
• ../
• ..\
• /
• \
• C:\