🛡️ Sentinel: [CRITICAL] Fix python command injection rule to detect os.system and os.popen

.jules/sentinel.md

@@ -127,3 +127,7 @@
 **Vulnerability:** The `/api/v1/webhook` POST endpoint in `appguardrail_core/controlplane.py` failed to validate the `url` property when accepting it into the database, leading to Stored SSRF risks. In addition, the core SSRF validation logic (`_is_safe_url`) in both the CLI and control-plane did not verify the input type (e.g. `isinstance(url, str)`). Passing non-string types (like integers) resulted in unhandled `AttributeError` exceptions inside `urllib.parse.urlparse`, which led to API 500 crashes on malicious JSON payloads.
 **Learning:** Network endpoints must explicitly validate the data type of user-provided configurations prior to execution or storage. Furthermore, webhooks configured by users should always be checked for SSRF when saved, as trusting them later assumes input has already been safely validated, bypassing downstream network guardrails.
 **Prevention:** Apply `_is_safe_url` checks directly upon ingestion (e.g., in `/api/v1/webhook`) and enforce type checks `if not isinstance(url, str): return False` prior to using library parsing functions like `urlparse`. Always return gracefully failing responses (like `400 Bad Request`) for unsafe URLs instead of allowing unhandled 500 server errors.
+## 2026-08-05 - Missing os.system command injection detection
+**Vulnerability:** The static analysis scanner's `python-command-injection` rule failed to detect command injections via `os.system` and `os.popen`.
+**Learning:** The previous regular expression assumed `os.system` and `os.popen` accepted a `shell=True` argument similar to `subprocess.run`, leading to false negatives as they execute via the shell implicitly and don't accept `shell=True`.
+**Prevention:** Ensure static analysis regex rules handling different APIs group them accurately according to their respective signatures rather than merging them under a single mandatory condition (like `shell=True`). Added tests to prevent regression.

CHANGELOG.md

@@ -7,6 +7,7 @@
 - 대시보드 검색창 커서 유지 — 검색어 중간에서 텍스트를 수정할 때마다 커서가 검색어의 맨 끝으로 점프하는 불편함을 수정했습니다. 이제 입력창의 커서 위치(`selectionStart`/`selectionEnd`)가 동적 렌더링 이후에도 원래 위치에 정확히 유지되어 자연스러운 타이핑 경험을 제공합니다.
 
 ### 보안
+- Python 명령 주입 탐지가 `os.system`·`os.popen`의 암묵적 셸 실행과 `subprocess(..., shell=True)`를 정확히 구분해 설명하고, 중첩된 명령 생성 호출 뒤의 `shell=True`까지 탐지하도록 보강했습니다. 각 API와 비셸 `subprocess` 음성 사례를 독립 회귀로 검증합니다.
 - 리포트 출력 하드닝 — 생성된 markdown 리포트가 HTML로 렌더될 때 악성 finding 내용(예: 외부 엔진이 스캔한 코드의 `<script>`)이 주입되지 않도록, 프로즈 필드(message/remediation/verification)를 HTML 이스케이프하고 snippet의 code-fence 탈출을 무력화합니다(모든 리포트 타입). rule_id/category/context 등 제약된 식별자는 그대로 둡니다.
 - control plane API 하드닝: (1) 요청 본문을 10MiB로 캡하고 음수 Content-Length를 거부합니다(유효 키 소지자의 OOM/EOF-hang 방지). (2) `limit`/`offset` 쿼리 파라미터를 클램프합니다 — sqlite에서 `LIMIT -1`은 무제한이므로 음수를 그대로 전달하면 페이지네이션 캡이 우회됐습니다(list 1..1000, trend 1..365, offset ≥0).
 

scanner/cli/appguardrail.py

@@ -454,10 +454,10 @@ def _console_print(*values, **kwargs) -> None:
     {
         "id": "python-command-injection",
         "pattern": re.compile(
-            r"(?i)(?:os\.system|subprocess\.(?:Popen|run|call|check_call|check_output))\s*\([^)]*shell\s*=\s*True"
+            r"(?is)(?:\bos\.(?:system|popen)\s*\(|\bsubprocess\.(?:Popen|run|call|check_call|check_output)\s*\((?:[^()]|\([^()]*\)){0,1200}\bshell\s*=\s*True)"
         ),
         "severity": "CRITICAL",
-        "message": "Potential Command Injection detected: shell=True used in Python subprocess/os command. [OWASP A03:2021 - Injection]",
+        "message": "Potential command injection sink detected: os.system/os.popen execute through a shell, and subprocess shell=True invokes a shell. Avoid shell execution, validate untrusted input, and use argument arrays where possible. [OWASP A03:2021 - Injection]",
         "extensions": [".py"],
     },
     {

tests/test_appguardrail.py

@@ -1828,3 +1828,84 @@ def test_cli_routes_console_calls_through_accessibility_wrapper():
     ]
 
     assert direct_print_lines == []
+
+
+@pytest.mark.parametrize(
+    ("filename", "source"),
+    [
+        pytest.param(
+            "os_system.py",
+            "os.system(user_input)\n",
+            id="os-system",
+        ),
+        pytest.param(
+            "os_popen.py",
+            "os.popen(command)\n",
+            id="os-popen",
+        ),
+        pytest.param(
+            "subprocess_shell.py",
+            "subprocess.call(command, shell=True)\n",
+            id="subprocess-shell",
+        ),
+        pytest.param(
+            "subprocess_nested_shell.py",
+            "subprocess.call(build_command(user_input), shell=True)\n",
+            id="nested-subprocess-shell",
+        ),
+    ],
+)
+def test_python_shell_spawning_apis_are_detected_independently(
+    tmp_path: Path,
+    filename: str,
+    source: str,
+) -> None:
+    """Detect each Python shell-spawning API without shared-fixture masking."""
+    target = tmp_path / filename
+    target.write_text(source, encoding="utf-8")
+
+    findings = _scan_file(target, tmp_path)
+
+    assert [item["rule_id"] for item in findings].count(
+        "python-command-injection"
+    ) == 1
+
+
+def test_python_shell_spawning_rule_describes_both_shell_mechanisms(
+    tmp_path: Path,
+) -> None:
+    """Explain implicit os shells separately from subprocess shell=True."""
+    target = tmp_path / "os_system.py"
+    target.write_text("os.system(user_input)\n", encoding="utf-8")
+
+    findings = [
+        item
+        for item in _scan_file(target, tmp_path)
+        if item["rule_id"] == "python-command-injection"
+    ]
+
+    assert len(findings) == 1
+    assert "os.system/os.popen execute through a shell" in findings[0]["message"]
+    assert "subprocess shell=True" in findings[0]["message"]
+
+
+@pytest.mark.parametrize(
+    "source",
+    [
+        "subprocess.call(command)\n",
+        "subprocess.call(command, shell=False)\n",
+    ],
+)
+def test_python_shell_spawning_rule_ignores_non_shell_subprocess_calls(
+    tmp_path: Path,
+    source: str,
+) -> None:
+    """Do not classify ordinary subprocess calls as shell execution."""
+    target = tmp_path / "subprocess_safe.py"
+    target.write_text(source, encoding="utf-8")
+
+    findings = _scan_file(target, tmp_path)
+
+    assert "python-command-injection" not in {
+        item["rule_id"] for item in findings
+    }