🛡️ Sentinel: [CRITICAL] Fix python command injection rule to detect os.system and os.popen

.jules/sentinel.md

@@ -127,3 +127,7 @@
 **Vulnerability:** The `/api/v1/webhook` POST endpoint in `appguardrail_core/controlplane.py` failed to validate the `url` property when accepting it into the database, leading to Stored SSRF risks. In addition, the core SSRF validation logic (`_is_safe_url`) in both the CLI and control-plane did not verify the input type (e.g. `isinstance(url, str)`). Passing non-string types (like integers) resulted in unhandled `AttributeError` exceptions inside `urllib.parse.urlparse`, which led to API 500 crashes on malicious JSON payloads.
 **Learning:** Network endpoints must explicitly validate the data type of user-provided configurations prior to execution or storage. Furthermore, webhooks configured by users should always be checked for SSRF when saved, as trusting them later assumes input has already been safely validated, bypassing downstream network guardrails.
 **Prevention:** Apply `_is_safe_url` checks directly upon ingestion (e.g., in `/api/v1/webhook`) and enforce type checks `if not isinstance(url, str): return False` prior to using library parsing functions like `urlparse`. Always return gracefully failing responses (like `400 Bad Request`) for unsafe URLs instead of allowing unhandled 500 server errors.
+## 2026-08-05 - Missing os.system command injection detection
+**Vulnerability:** The static analysis scanner's `python-command-injection` rule failed to detect command injections via `os.system` and `os.popen`.
+**Learning:** The previous regular expression assumed `os.system` and `os.popen` accepted a `shell=True` argument similar to `subprocess.run`, leading to false negatives as they execute via the shell implicitly and don't accept `shell=True`.
+**Prevention:** Ensure static analysis regex rules handling different APIs group them accurately according to their respective signatures rather than merging them under a single mandatory condition (like `shell=True`). Added tests to prevent regression.

scanner/cli/appguardrail.py

@@ -454,7 +454,7 @@ def _console_print(*values, **kwargs) -> None:
     {
         "id": "python-command-injection",
         "pattern": re.compile(
-            r"(?i)(?:os\.system|subprocess\.(?:Popen|run|call|check_call|check_output))\s*\([^)]*shell\s*=\s*True"
+            r"(?i)(?:os\.(?:system|popen)\s*\(|subprocess\.(?:Popen|run|call|check_call|check_output)\s*\([^)]*shell\s*=\s*True)"
         ),
         "severity": "CRITICAL",
         "message": "Potential Command Injection detected: shell=True used in Python subprocess/os command. [OWASP A03:2021 - Injection]",

tests/test_appguardrail.py

@@ -231,6 +231,10 @@ def test_scan_file_detects_strix_derived_patterns(tmp_path):
             "content": 'subprocess.run(f"ffmpeg -i {source_path}")\n',
             "ids": {"python-subprocess-string-command"},
         },
+        "cmd_injection.py": {
+            "content": "os.system(user_input)\nos.popen(cmd)\nsubprocess.call(cmd, shell=True)\n",
+            "ids": {"python-command-injection"},
+        },
         "api.py": {
             "content": "raise HTTPException(status_code=500) from exc\n",
             "ids": {"http-exception-chains-internal-error"},