No detection when passing keyword args to subprocess/shell functions

[David Wyde]

Multiple plugins in bandit/plugins/injection_shell.py assume that a command will be passed in as a positional argument. When keyword arguments are used, the plugins don't even report that a call occurred.

The only issue that Bandit reports against the below Python 2 code is the import of "subprocess":

    import commands
    commands.getoutput(cmd='ls')

    import os
    os.popen2(mode='r', cmd='ls')

    import subprocess
    subprocess.Popen(args='ls', shell=True)

I think a solution for the shell injection plugins is to check for either args[0] *or* kwargs['cmd']/kwargs['args']/etc., depending on the function.

Note: this quirk only applies to Python-defined functions. Built-in functions, like os.system() on Python 2, won't accept keyword arguments.

[Travis McPeak (travis-mcpeak)]

Good catch!