Repository: DataDog/guarddog (language: python)

Issue:
Identify subprocess.Popen in setup.py
c.f. e.g. tphydraencode or https://blog.phylum.io/phylum-discovers-another-attack-on-pypi

Sample:

```python
try:
  import subprocess
  import os
  if not os.path.exists('tahg'):
    # www.esquelesquad.rip
    subprocess.Popen('powershell -WindowStyle Hidden -EncodedCommand cABvAHc..', shell=False, creationflags=subprocess.CREATE_NO_WINDOW)
except: pass
```


Discussion / hints:

Fix patch:
diff --git a/guarddog/analyzer/sourcecode/code-execution.yml b/guarddog/analyzer/sourcecode/code-execution.yml
index 8c4e9836..3939394a 100644
--- a/guarddog/analyzer/sourcecode/code-execution.yml
+++ b/guarddog/analyzer/sourcecode/code-execution.yml
@@ -65,14 +65,14 @@ rules:
                             - pattern-not-regex: version
 
           # popen functions
-          - pattern: subprocess.Popen("$ARG1", ...)
-          - pattern: subprocess.Popen([..., "$ARG1", ...], ...)
-          - pattern: os.popen("$ARG1", ...)
-          - pattern: os.popen([..., "$ARG1", ...], ...)
-          - pattern: Popen("$ARG1", ...)
-          - pattern: Popen([..., "$ARG1", ...], ...)
-          - pattern: popen("$ARG1", ...)
-          - pattern: popen([..., "$ARG1", ...], ...)
+          - pattern: subprocess.Popen($ARG1, ...)
+          - pattern: subprocess.Popen([..., $ARG1, ...], ...)
+          - pattern: os.popen($ARG1, ...)
+          - pattern: os.popen([..., $ARG1, ...], ...)
+          - pattern: Popen($ARG1, ...)
+          - pattern: Popen([..., $ARG1, ...], ...)
+          - pattern: popen($ARG1, ...)
+          - pattern: popen([..., $ARG1, ...], ...)
 
           # miscellaneous
           - pattern: os.system($ARG1, ...)


Test patch:
diff --git a/tests/analyzer/sourcecode/code-execution.py b/tests/analyzer/sourcecode/code-execution.py
index 673c07b4..217fa99c 100644
--- a/tests/analyzer/sourcecode/code-execution.py
+++ b/tests/analyzer/sourcecode/code-execution.py
@@ -98,16 +98,13 @@ def get_version():
 
 def RunCustomCommand(command_list):
     print("Running command: %s" % command_list)
-    # ok: code-execution
+    # ruleid: code-execution
     p = subprocess.Popen(command_list, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
 
 
 # ok: code-execution
 subprocess.run(["python3", "-m", "pycodestyle", "."], env=env, check=True)
 
-# ok: code-execution
-p = subprocess.Popen([pkg_config, option, "libffi"])
-
 # ok: code-execution
 os.system("coverage report")
 
@@ -176,4 +173,15 @@ def RunCustomCommand(command_list):
 OOO0O0OOOOO000oOo0oOoOo0,llIIlIlllllIlIlIlll,Oo000O0OO0oO0oO00oO0oO0O,WXWXXWWXXWXWXWWXXXWXXWX,XWWWWXXXXWWWWWXXWWX=(lambda SS2S222S22SS22S22S:SS2S222S22SS22S22S(__import__('\x7a\x6c\x69\x62'))),(lambda SS2S222S22SS22S22S:globals()['\x65\x76\x61\x6c'](globals()['\x63\x6f\x6d\x70\x69\x6c\x65'](globals()['\x73\x74\x72'])))
 
 # ok: code-execution
-errno = subprocess.call([sys.executable, "tests.py"])
\ No newline at end of file
+errno = subprocess.call([sys.executable, "tests.py"])
+
+
+
+"""
+https://github.com/DataDog/guarddog/issues/178
+"""
+# ruleid: code-execution
+subprocess.Popen('powershell -WindowStyle Hidden -EncodedCommand cABvAHc..', shell=False, creationflags=subprocess.CREATE_NO_WINDOW)
+
+# ruleid: code-execution
+os.popen("powershell foo", stderr=subprocess.PIPE, stdout=subprocess.PIPE)
\ No newline at end of file