Current command injection behavior isn't correct

[ericwb]

Consider the following test file:

import subprocess
my_val = 'do_something; ' + evil_value
subprocess.Popen(my_val, shell=True)

This is obviously a high risk command injection issue, but Bandit currently only reports a low. Since all we can tell is that it's a dynamically constructed string we have to assume HIGH severity IMO.

[ericwb]

Bad import of bug from launchpad. Closing..