vtcode 0.123.7

A Rust-based terminal coding agent with modular architecture supporting multiple LLM providers
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

id: no-os-system-injection
language: python
severity: error
message: Avoid `os.system()` with string interpolation; use `subprocess.run` with a list.
note: |
  `os.system(cmd)` passes the string to a shell, enabling command injection
  when the string contains user-controlled input. Use `subprocess.run([cmd, arg1, ...])`
  which bypasses the shell entirely. This rule flags `os.system` calls that
  contain string concatenation, f-string interpolation, `.format()`, or
  `%` formatting, which are common injection vectors.
rule:
  any:
    - pattern: os.system($A + $B)
    - pattern: os.system($A + $B + $C)
    - pattern: os.system(f"...{$A}...")
    - pattern: os.system("...{}...".format($A))
    - pattern: os.system("...%s..." % $A)
files:
  - "**/*.py"
  - "!tests/**"
  - "!**/test_*.py"
  - "!**/*_test.py"