pexpect spawns interactive subprocesses with expect/respond patterns. spawn(cmd, ...) on user-controlled cmd is a command-injection sink, equivalent to subprocess with shell=True.
.spawn().run().spawn()Sinkpexpect.spawn(command, args=[], timeout=30, ...) -> spawn
Spawns a child process. Command-injection sink on user-controlled command.
0.run()Sinkpexpect.run(command, timeout=30, events=None, extra_args=None, logfile=None, ...) -> bytes
Runs a command and returns output. Sink on user-controlled command.
0| FQN | Field | |
|---|---|---|
| pexpect | fqns[0] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyPexpect