From 399582580fb26d42844a90ce96ecc3ffeae306d1 Mon Sep 17 00:00:00 2001
From: Lalith Chaitanya Mangalagiri <lcmangalagiri@users.noreply.github.com>
Date: Tue, 11 Aug 2026 21:32:11 -0700
Subject: [PATCH 1/9] Rust: Add command injection query (CWE-078)

Detects user-controlled data flowing into std::process::Command and
tokio::process::Command (both command name and arguments).

- Extension library with sources, sinks, and barriers
- Models-as-data sinks for Command::new, .arg(), .args() (std + tokio)
- Query help (.qhelp) with examples
- Test cases with inline expectations

Query ID: rust/command-line-injection
---
 .../rust/frameworks/stdlib/process.model.yml  | 15 ++++
 .../security/CommandInjectionExtensions.qll   | 64 ++++++++++++++++
 .../security/CWE-078/CommandInjection.qhelp   | 40 ++++++++++
 .../security/CWE-078/CommandInjection.ql      | 42 +++++++++++
 .../security/CWE-078/CommandInjectionBad.rs   | 10 +++
 .../security/CWE-078/CommandInjectionGood.rs  | 13 ++++
 .../security/CWE-078/CommandInjection.qlref   |  4 +
 .../test/query-tests/security/CWE-078/main.rs | 75 +++++++++++++++++++
 .../query-tests/security/CWE-078/options.yml  |  4 +
 9 files changed, 267 insertions(+)
 create mode 100644 rust/ql/lib/codeql/rust/frameworks/stdlib/process.model.yml
 create mode 100644 rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll
 create mode 100644 rust/ql/src/queries/security/CWE-078/CommandInjection.qhelp
 create mode 100644 rust/ql/src/queries/security/CWE-078/CommandInjection.ql
 create mode 100644 rust/ql/src/queries/security/CWE-078/CommandInjectionBad.rs
 create mode 100644 rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs
 create mode 100644 rust/ql/test/query-tests/security/CWE-078/CommandInjection.qlref
 create mode 100644 rust/ql/test/query-tests/security/CWE-078/main.rs
 create mode 100644 rust/ql/test/query-tests/security/CWE-078/options.yml

diff --git a/rust/ql/lib/codeql/rust/frameworks/stdlib/process.model.yml b/rust/ql/lib/codeql/rust/frameworks/stdlib/process.model.yml
new file mode 100644
index 000000000000..0187f073d679
--- /dev/null
+++ b/rust/ql/lib/codeql/rust/frameworks/stdlib/process.model.yml
@@ -0,0 +1,15 @@
+extensions:
+  - addsTo:
+      pack: codeql/rust-all
+      extensible: sinkModel
+    data:
+      # std::process::Command - the command name itself
+      - ["<std::process::Command>::new", "Argument[0]", "command-injection", "manual"]
+      # std::process::Command - arguments passed to the command
+      - ["<std::process::Command>::arg", "Argument[0]", "command-injection", "manual"]
+      - ["<std::process::Command>::args", "Argument[0]", "command-injection", "manual"]
+      # tokio::process::Command - the command name itself
+      - ["<tokio::process::Command>::new", "Argument[0]", "command-injection", "manual"]
+      # tokio::process::Command - arguments passed to the command
+      - ["<tokio::process::Command>::arg", "Argument[0]", "command-injection", "manual"]
+      - ["<tokio::process::Command>::args", "Argument[0]", "command-injection", "manual"]
diff --git a/rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll b/rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll
new file mode 100644
index 000000000000..7e0150d53f66
--- /dev/null
+++ b/rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll
@@ -0,0 +1,64 @@
+/**
+ * Provides classes and predicates for reasoning about command injection
+ * vulnerabilities (CWE-078).
+ */
+
+import rust
+private import codeql.rust.dataflow.DataFlow
+private import codeql.rust.dataflow.FlowSink
+private import codeql.rust.dataflow.FlowBarrier
+private import codeql.rust.Concepts
+private import codeql.rust.security.Barriers as Barriers
+
+/**
+ * Provides default sources, sinks and barriers for detecting command injection
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+module CommandInjection {
+  /**
+   * A data flow source for command injection vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for command injection vulnerabilities.
+   */
+  abstract class Sink extends QuerySink::Range {
+    override string getSinkType() { result = "CommandInjection" }
+  }
+
+  /**
+   * A barrier for command injection vulnerabilities.
+   */
+  abstract class Barrier extends DataFlow::Node { }
+
+  /**
+   * An active threat-model source, considered as a flow source.
+   */
+  private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
+
+  /**
+   * A sink for command injection from model data.
+   */
+  private class ModelsAsDataSink extends Sink {
+    ModelsAsDataSink() { sinkNode(this, "command-injection") }
+  }
+
+  /**
+   * A barrier for command injection from model data.
+   */
+  private class ModelsAsDataBarrier extends Barrier {
+    ModelsAsDataBarrier() { barrierNode(this, "command-injection") }
+  }
+
+  /**
+   * A barrier for command injection vulnerabilities for nodes whose type is a
+   * numeric type, which is unlikely to expose any vulnerability.
+   */
+  private class NumericTypeBarrier extends Barrier instanceof Barriers::NumericTypeBarrier { }
+
+  private class BooleanTypeBarrier extends Barrier instanceof Barriers::BooleanTypeBarrier { }
+
+  private class FieldlessEnumTypeBarrier extends Barrier instanceof Barriers::FieldlessEnumTypeBarrier
+  { }
+}
diff --git a/rust/ql/src/queries/security/CWE-078/CommandInjection.qhelp b/rust/ql/src/queries/security/CWE-078/CommandInjection.qhelp
new file mode 100644
index 000000000000..3e7b336090b4
--- /dev/null
+++ b/rust/ql/src/queries/security/CWE-078/CommandInjection.qhelp
@@ -0,0 +1,40 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+
+<p>
+If a system command is built from user-provided data without sufficient sanitization, a user may be able to run malicious commands. An attacker can craft input to change the meaning of the command, potentially gaining control of the system.
+</p>
+
+</overview>
+<recommendation>
+
+<p>
+If possible, use hard-coded string literals for commands. If the command must be built from user-provided data, do not pass user input directly to shell commands. Instead, use APIs that accept command arguments as separate parameters (such as <code>std::process::Command</code> with individual <code>.arg()</code> calls for each argument), which avoids shell interpretation of special characters. If shell execution is necessary, validate and sanitize user input against an allowlist of permitted values.
+</p>
+
+</recommendation>
+<example>
+
+<p>
+In the following example, a command is constructed directly from user-controlled input obtained via an HTTP request. An attacker could supply a malicious value to execute arbitrary commands.
+</p>
+
+<sample src="CommandInjectionBad.rs" />
+
+<p>
+A safer approach uses a fixed command with validated arguments, or avoids shell interpretation entirely:
+</p>
+
+<sample src="CommandInjectionGood.rs" />
+
+</example>
+<references>
+
+<li>OWASP: <a href="https://owasp.org/www-community/attacks/Command_Injection">Command Injection</a>.</li>
+<li>Wikipedia: <a href="https://en.wikipedia.org/wiki/Code_injection#Shell_injection">Shell injection</a>.</li>
+
+</references>
+</qhelp>
diff --git a/rust/ql/src/queries/security/CWE-078/CommandInjection.ql b/rust/ql/src/queries/security/CWE-078/CommandInjection.ql
new file mode 100644
index 000000000000..b6e93a8d88a1
--- /dev/null
+++ b/rust/ql/src/queries/security/CWE-078/CommandInjection.ql
@@ -0,0 +1,42 @@
+/**
+ * @name Uncontrolled command line
+ * @description Using externally controlled strings in a command line may allow a malicious
+ *              user to change the meaning of the command.
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 9.8
+ * @precision high
+ * @id rust/command-line-injection
+ * @tags security
+ *       external/cwe/cwe-078
+ *       external/cwe/cwe-088
+ */
+
+import rust
+import codeql.rust.dataflow.DataFlow
+import codeql.rust.dataflow.TaintTracking
+import codeql.rust.security.CommandInjectionExtensions
+
+/**
+ * A taint configuration for detecting command injection vulnerabilities.
+ */
+module CommandInjectionConfig implements DataFlow::ConfigSig {
+  import CommandInjection
+
+  predicate isSource(DataFlow::Node node) { node instanceof Source }
+
+  predicate isSink(DataFlow::Node node) { node instanceof Sink }
+
+  predicate isBarrier(DataFlow::Node barrier) { barrier instanceof Barrier }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+}
+
+module CommandInjectionFlow = TaintTracking::Global<CommandInjectionConfig>;
+
+import CommandInjectionFlow::PathGraph
+
+from CommandInjectionFlow::PathNode sourceNode, CommandInjectionFlow::PathNode sinkNode
+where CommandInjectionFlow::flowPath(sourceNode, sinkNode)
+select sinkNode.getNode(), sourceNode, sinkNode, "This command line depends on a $@.",
+  sourceNode.getNode(), "user-provided value"
diff --git a/rust/ql/src/queries/security/CWE-078/CommandInjectionBad.rs b/rust/ql/src/queries/security/CWE-078/CommandInjectionBad.rs
new file mode 100644
index 000000000000..fa81cef9fe15
--- /dev/null
+++ b/rust/ql/src/queries/security/CWE-078/CommandInjectionBad.rs
@@ -0,0 +1,10 @@
+use std::process::Command;
+
+fn handle_request(user_input: &str) {
+    // BAD: user input is passed directly to a shell command
+    Command::new("sh")
+        .arg("-c")
+        .arg(user_input)
+        .output()
+        .expect("failed to execute");
+}
diff --git a/rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs b/rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs
new file mode 100644
index 000000000000..bb720d39d03e
--- /dev/null
+++ b/rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs
@@ -0,0 +1,13 @@
+use std::process::Command;
+
+fn handle_request(filename: &str) {
+    // GOOD: use a fixed command with the user input as a separate argument,
+    // avoiding shell interpretation
+    let allowed_names = ["report.pdf", "summary.txt", "data.csv"];
+    if allowed_names.contains(&filename) {
+        Command::new("cat")
+            .arg(filename)
+            .output()
+            .expect("failed to execute");
+    }
+}
diff --git a/rust/ql/test/query-tests/security/CWE-078/CommandInjection.qlref b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.qlref
new file mode 100644
index 000000000000..3b14f15fafe6
--- /dev/null
+++ b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.qlref
@@ -0,0 +1,4 @@
+query: queries/security/CWE-078/CommandInjection.ql
+postprocess:
+ - utils/test/PrettyPrintModels.ql
+ - utils/test/InlineExpectationsTestQuery.ql
diff --git a/rust/ql/test/query-tests/security/CWE-078/main.rs b/rust/ql/test/query-tests/security/CWE-078/main.rs
new file mode 100644
index 000000000000..eecf95cec33d
--- /dev/null
+++ b/rust/ql/test/query-tests/security/CWE-078/main.rs
@@ -0,0 +1,75 @@
+use std::process::Command;
+
+fn test_std_command_injection() {
+    let arg_string = std::env::args().nth(1).unwrap_or(String::from("ls")); // $ Source=args1
+    let remote_string = reqwest::blocking::get("http://example.com/") // $ Source=remote1
+        .unwrap()
+        .text()
+        .unwrap_or(String::from("ls"));
+    let const_string = String::from("echo hello");
+
+    // --- safe cases ---
+
+    // Constant command and argument
+    Command::new("ls")
+        .arg("-la")
+        .output()
+        .expect("failed"); // safe
+
+    // Constant constructed command
+    Command::new(const_string.as_str())
+        .output()
+        .expect("failed"); // safe
+
+    // --- unsafe cases ---
+
+    // User input as the command itself
+    Command::new(arg_string.as_str()) // $ Alert[rust/command-line-injection]=args1
+        .output()
+        .expect("failed");
+
+    // User input as an argument to sh -c
+    Command::new("sh")
+        .arg("-c")
+        .arg(remote_string.as_str()) // $ Alert[rust/command-line-injection]=remote1
+        .output()
+        .expect("failed");
+
+    // User input as an argument
+    Command::new("grep")
+        .arg(arg_string.as_str()) // $ Alert[rust/command-line-injection]=args1
+        .arg("file.txt")
+        .output()
+        .expect("failed");
+
+    // Remote input via args()
+    Command::new("bash")
+        .args(&["-c", remote_string.as_str()]) // $ Alert[rust/command-line-injection]=remote1
+        .output()
+        .expect("failed");
+}
+
+async fn test_tokio_command_injection() {
+    let remote_string = reqwest::blocking::get("http://example.com/") // $ Source=remote2
+        .unwrap()
+        .text()
+        .unwrap_or(String::from("ls"));
+
+    // Unsafe: remote input as tokio command
+    let _output = tokio::process::Command::new(remote_string.as_str()) // $ Alert[rust/command-line-injection]=remote2
+        .output()
+        .await
+        .expect("failed");
+
+    // Unsafe: remote input as tokio command argument
+    tokio::process::Command::new("sh")
+        .arg("-c")
+        .arg(remote_string.as_str()) // $ Alert[rust/command-line-injection]=remote2
+        .output()
+        .await
+        .expect("failed");
+}
+
+fn main() {
+    test_std_command_injection();
+}
diff --git a/rust/ql/test/query-tests/security/CWE-078/options.yml b/rust/ql/test/query-tests/security/CWE-078/options.yml
new file mode 100644
index 000000000000..78cb2f883af1
--- /dev/null
+++ b/rust/ql/test/query-tests/security/CWE-078/options.yml
@@ -0,0 +1,4 @@
+qltest_cargo_check: true
+qltest_dependencies:
+    - reqwest = { version = "0.12.9", features = ["blocking"] }
+    - tokio = { version = "1", features = ["full"] }

From 22ab3706421e309879fcf84143b1f4e5ecfb4de0 Mon Sep 17 00:00:00 2001
From: Lalith Chaitanya Mangalagiri <lcmangalagiri@users.noreply.github.com>
Date: Tue, 11 Aug 2026 21:49:23 -0700
Subject: [PATCH 2/9] Add change note for rust/command-line-injection query

---
 rust/ql/src/change-notes/2026-08-11-command-injection.md | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 rust/ql/src/change-notes/2026-08-11-command-injection.md

diff --git a/rust/ql/src/change-notes/2026-08-11-command-injection.md b/rust/ql/src/change-notes/2026-08-11-command-injection.md
new file mode 100644
index 000000000000..2175cc9cdf18
--- /dev/null
+++ b/rust/ql/src/change-notes/2026-08-11-command-injection.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new query, `rust/command-line-injection`, to detect uncontrolled command lines.

From db15d09880c453b1b9596c5da971ec7f75fc931c Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 13 Aug 2026 20:13:52 +0100
Subject: [PATCH 3/9] Rust: Add the test .expected file.

---
 .../CWE-078/CommandInjection.expected         | 96 +++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100644 rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected

diff --git a/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
new file mode 100644
index 000000000000..29906c333d44
--- /dev/null
+++ b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
@@ -0,0 +1,96 @@
+#select
+| main.rs:27:5:27:16 | ...::new | main.rs:4:22:4:35 | ...::args | main.rs:27:5:27:16 | ...::new | This command line depends on a $@. | main.rs:4:22:4:35 | ...::args | user-provided value |
+| main.rs:34:10:34:12 | arg | main.rs:5:25:5:46 | ...::get | main.rs:34:10:34:12 | arg | This command line depends on a $@. | main.rs:5:25:5:46 | ...::get | user-provided value |
+| main.rs:40:10:40:12 | arg | main.rs:4:22:4:35 | ...::args | main.rs:40:10:40:12 | arg | This command line depends on a $@. | main.rs:4:22:4:35 | ...::args | user-provided value |
+| main.rs:47:10:47:13 | args | main.rs:5:25:5:46 | ...::get | main.rs:47:10:47:13 | args | This command line depends on a $@. | main.rs:5:25:5:46 | ...::get | user-provided value |
+| main.rs:59:19:59:46 | ...::new | main.rs:53:25:53:46 | ...::get | main.rs:59:19:59:46 | ...::new | This command line depends on a $@. | main.rs:53:25:53:46 | ...::get | user-provided value |
+| main.rs:67:10:67:12 | arg | main.rs:53:25:53:46 | ...::get | main.rs:67:10:67:12 | arg | This command line depends on a $@. | main.rs:53:25:53:46 | ...::get | user-provided value |
+edges
+| main.rs:4:9:4:18 | arg_string | main.rs:27:18:27:27 | arg_string | provenance |  |
+| main.rs:4:9:4:18 | arg_string | main.rs:40:14:40:23 | arg_string | provenance |  |
+| main.rs:4:22:4:35 | ...::args | main.rs:4:22:4:37 | ...::args(...) [element] | provenance | Src:MaD:7  |
+| main.rs:4:22:4:37 | ...::args(...) [element] | main.rs:4:22:4:44 | ... .nth(...) [Some] | provenance | MaD:8 |
+| main.rs:4:22:4:44 | ... .nth(...) [Some] | main.rs:4:22:4:74 | ... .unwrap_or(...) | provenance | MaD:10 |
+| main.rs:4:22:4:74 | ... .unwrap_or(...) | main.rs:4:9:4:18 | arg_string | provenance |  |
+| main.rs:5:9:5:21 | remote_string | main.rs:34:14:34:26 | remote_string | provenance |  |
+| main.rs:5:9:5:21 | remote_string | main.rs:47:23:47:35 | remote_string | provenance |  |
+| main.rs:5:25:5:46 | ...::get | main.rs:5:25:5:69 | ...::get(...) [Ok] | provenance | Src:MaD:6  |
+| main.rs:5:25:5:69 | ...::get(...) [Ok] | main.rs:5:25:6:17 | ... .unwrap() | provenance | MaD:11 |
+| main.rs:5:25:6:17 | ... .unwrap() | main.rs:5:25:7:15 | ... .text() [Ok] | provenance | MaD:13 |
+| main.rs:5:25:7:15 | ... .text() [Ok] | main.rs:5:25:8:38 | ... .unwrap_or(...) | provenance | MaD:12 |
+| main.rs:5:25:8:38 | ... .unwrap_or(...) | main.rs:5:9:5:21 | remote_string | provenance |  |
+| main.rs:27:18:27:27 | arg_string | main.rs:27:18:27:36 | arg_string.as_str() [&ref] | provenance | MaD:9 |
+| main.rs:27:18:27:36 | arg_string.as_str() [&ref] | main.rs:27:5:27:16 | ...::new | provenance | MaD:3 Sink:MaD:3 |
+| main.rs:34:14:34:26 | remote_string | main.rs:34:14:34:35 | remote_string.as_str() [&ref] | provenance | MaD:9 |
+| main.rs:34:14:34:35 | remote_string.as_str() [&ref] | main.rs:34:10:34:12 | arg | provenance | MaD:1 Sink:MaD:1 |
+| main.rs:40:14:40:23 | arg_string | main.rs:40:14:40:32 | arg_string.as_str() [&ref] | provenance | MaD:9 |
+| main.rs:40:14:40:32 | arg_string.as_str() [&ref] | main.rs:40:10:40:12 | arg | provenance | MaD:1 Sink:MaD:1 |
+| main.rs:47:15:47:45 | &... [&ref, element, &ref] | main.rs:47:10:47:13 | args | provenance | MaD:2 Sink:MaD:2 Sink:MaD:2 |
+| main.rs:47:15:47:45 | &... [&ref, element, &ref] | main.rs:47:10:47:13 | args | provenance | MaD:2 Sink:MaD:2 Sink:MaD:2 Sink:MaD:2 |
+| main.rs:47:16:47:45 | [...] [element, &ref] | main.rs:47:15:47:45 | &... [&ref, element, &ref] | provenance |  |
+| main.rs:47:23:47:35 | remote_string | main.rs:47:23:47:44 | remote_string.as_str() [&ref] | provenance | MaD:9 |
+| main.rs:47:23:47:44 | remote_string.as_str() [&ref] | main.rs:47:16:47:45 | [...] [element, &ref] | provenance |  |
+| main.rs:53:9:53:21 | remote_string | main.rs:59:48:59:60 | remote_string | provenance |  |
+| main.rs:53:9:53:21 | remote_string | main.rs:67:14:67:26 | remote_string | provenance |  |
+| main.rs:53:25:53:46 | ...::get | main.rs:53:25:53:69 | ...::get(...) [Ok] | provenance | Src:MaD:6  |
+| main.rs:53:25:53:69 | ...::get(...) [Ok] | main.rs:53:25:54:17 | ... .unwrap() | provenance | MaD:11 |
+| main.rs:53:25:54:17 | ... .unwrap() | main.rs:53:25:55:15 | ... .text() [Ok] | provenance | MaD:13 |
+| main.rs:53:25:55:15 | ... .text() [Ok] | main.rs:53:25:56:38 | ... .unwrap_or(...) | provenance | MaD:12 |
+| main.rs:53:25:56:38 | ... .unwrap_or(...) | main.rs:53:9:53:21 | remote_string | provenance |  |
+| main.rs:59:48:59:60 | remote_string | main.rs:59:48:59:69 | remote_string.as_str() [&ref] | provenance | MaD:9 |
+| main.rs:59:48:59:69 | remote_string.as_str() [&ref] | main.rs:59:19:59:46 | ...::new | provenance | MaD:5 Sink:MaD:5 |
+| main.rs:67:14:67:26 | remote_string | main.rs:67:14:67:35 | remote_string.as_str() [&ref] | provenance | MaD:9 |
+| main.rs:67:14:67:35 | remote_string.as_str() [&ref] | main.rs:67:10:67:12 | arg | provenance | MaD:4 Sink:MaD:4 |
+models
+| 1 | Sink: <std::process::Command>::arg; Argument[0]; command-injection |
+| 2 | Sink: <std::process::Command>::args; Argument[0]; command-injection |
+| 3 | Sink: <std::process::Command>::new; Argument[0]; command-injection |
+| 4 | Sink: <tokio::process::Command>::arg; Argument[0]; command-injection |
+| 5 | Sink: <tokio::process::Command>::new; Argument[0]; command-injection |
+| 6 | Source: reqwest::blocking::get; ReturnValue.Field[core::result::Result::Ok(0)]; remote |
+| 7 | Source: std::env::args; ReturnValue.Element; commandargs |
+| 8 | Summary: <_ as core::iter::traits::iterator::Iterator>::nth; Argument[self].Reference.Element; ReturnValue.Field[core::option::Option::Some(0)]; value |
+| 9 | Summary: <alloc::string::String>::as_str; Argument[self].Reference; ReturnValue.Reference; taint |
+| 10 | Summary: <core::option::Option>::unwrap_or; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
+| 11 | Summary: <core::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
+| 12 | Summary: <core::result::Result>::unwrap_or; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
+| 13 | Summary: <reqwest::blocking::response::Response>::text; Argument[self]; ReturnValue.Field[core::result::Result::Ok(0)]; taint |
+nodes
+| main.rs:4:9:4:18 | arg_string | semmle.label | arg_string |
+| main.rs:4:22:4:35 | ...::args | semmle.label | ...::args |
+| main.rs:4:22:4:37 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
+| main.rs:4:22:4:44 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
+| main.rs:4:22:4:74 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
+| main.rs:5:9:5:21 | remote_string | semmle.label | remote_string |
+| main.rs:5:25:5:46 | ...::get | semmle.label | ...::get |
+| main.rs:5:25:5:69 | ...::get(...) [Ok] | semmle.label | ...::get(...) [Ok] |
+| main.rs:5:25:6:17 | ... .unwrap() | semmle.label | ... .unwrap() |
+| main.rs:5:25:7:15 | ... .text() [Ok] | semmle.label | ... .text() [Ok] |
+| main.rs:5:25:8:38 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
+| main.rs:27:5:27:16 | ...::new | semmle.label | ...::new |
+| main.rs:27:18:27:27 | arg_string | semmle.label | arg_string |
+| main.rs:27:18:27:36 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
+| main.rs:34:10:34:12 | arg | semmle.label | arg |
+| main.rs:34:14:34:26 | remote_string | semmle.label | remote_string |
+| main.rs:34:14:34:35 | remote_string.as_str() [&ref] | semmle.label | remote_string.as_str() [&ref] |
+| main.rs:40:10:40:12 | arg | semmle.label | arg |
+| main.rs:40:14:40:23 | arg_string | semmle.label | arg_string |
+| main.rs:40:14:40:32 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
+| main.rs:47:10:47:13 | args | semmle.label | args |
+| main.rs:47:15:47:45 | &... [&ref, element, &ref] | semmle.label | &... [&ref, element, &ref] |
+| main.rs:47:16:47:45 | [...] [element, &ref] | semmle.label | [...] [element, &ref] |
+| main.rs:47:23:47:35 | remote_string | semmle.label | remote_string |
+| main.rs:47:23:47:44 | remote_string.as_str() [&ref] | semmle.label | remote_string.as_str() [&ref] |
+| main.rs:53:9:53:21 | remote_string | semmle.label | remote_string |
+| main.rs:53:25:53:46 | ...::get | semmle.label | ...::get |
+| main.rs:53:25:53:69 | ...::get(...) [Ok] | semmle.label | ...::get(...) [Ok] |
+| main.rs:53:25:54:17 | ... .unwrap() | semmle.label | ... .unwrap() |
+| main.rs:53:25:55:15 | ... .text() [Ok] | semmle.label | ... .text() [Ok] |
+| main.rs:53:25:56:38 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
+| main.rs:59:19:59:46 | ...::new | semmle.label | ...::new |
+| main.rs:59:48:59:60 | remote_string | semmle.label | remote_string |
+| main.rs:59:48:59:69 | remote_string.as_str() [&ref] | semmle.label | remote_string.as_str() [&ref] |
+| main.rs:67:10:67:12 | arg | semmle.label | arg |
+| main.rs:67:14:67:26 | remote_string | semmle.label | remote_string |
+| main.rs:67:14:67:35 | remote_string.as_str() [&ref] | semmle.label | remote_string.as_str() [&ref] |
+subpaths

From c412722c3acba43b9ae83e93b44dbe4510612bc5 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 13 Aug 2026 20:25:28 +0100
Subject: [PATCH 4/9] Rust: Add a test case containing string concatenation.

---
 .../CWE-078/CommandInjection.expected         | 69 ++++++++++++-------
 .../test/query-tests/security/CWE-078/main.rs |  7 ++
 2 files changed, 51 insertions(+), 25 deletions(-)

diff --git a/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
index 29906c333d44..21485f4e3a3b 100644
--- a/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
+++ b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
@@ -3,8 +3,9 @@
 | main.rs:34:10:34:12 | arg | main.rs:5:25:5:46 | ...::get | main.rs:34:10:34:12 | arg | This command line depends on a $@. | main.rs:5:25:5:46 | ...::get | user-provided value |
 | main.rs:40:10:40:12 | arg | main.rs:4:22:4:35 | ...::args | main.rs:40:10:40:12 | arg | This command line depends on a $@. | main.rs:4:22:4:35 | ...::args | user-provided value |
 | main.rs:47:10:47:13 | args | main.rs:5:25:5:46 | ...::get | main.rs:47:10:47:13 | args | This command line depends on a $@. | main.rs:5:25:5:46 | ...::get | user-provided value |
-| main.rs:59:19:59:46 | ...::new | main.rs:53:25:53:46 | ...::get | main.rs:59:19:59:46 | ...::new | This command line depends on a $@. | main.rs:53:25:53:46 | ...::get | user-provided value |
-| main.rs:67:10:67:12 | arg | main.rs:53:25:53:46 | ...::get | main.rs:67:10:67:12 | arg | This command line depends on a $@. | main.rs:53:25:53:46 | ...::get | user-provided value |
+| main.rs:53:5:53:16 | ...::new | main.rs:5:25:5:46 | ...::get | main.rs:53:5:53:16 | ...::new | This command line depends on a $@. | main.rs:5:25:5:46 | ...::get | user-provided value |
+| main.rs:65:19:65:46 | ...::new | main.rs:59:25:59:46 | ...::get | main.rs:65:19:65:46 | ...::new | This command line depends on a $@. | main.rs:59:25:59:46 | ...::get | user-provided value |
+| main.rs:73:10:73:12 | arg | main.rs:59:25:59:46 | ...::get | main.rs:73:10:73:12 | arg | This command line depends on a $@. | main.rs:59:25:59:46 | ...::get | user-provided value |
 edges
 | main.rs:4:9:4:18 | arg_string | main.rs:27:18:27:27 | arg_string | provenance |  |
 | main.rs:4:9:4:18 | arg_string | main.rs:40:14:40:23 | arg_string | provenance |  |
@@ -14,6 +15,7 @@ edges
 | main.rs:4:22:4:74 | ... .unwrap_or(...) | main.rs:4:9:4:18 | arg_string | provenance |  |
 | main.rs:5:9:5:21 | remote_string | main.rs:34:14:34:26 | remote_string | provenance |  |
 | main.rs:5:9:5:21 | remote_string | main.rs:47:23:47:35 | remote_string | provenance |  |
+| main.rs:5:9:5:21 | remote_string | main.rs:52:40:52:69 | MacroExpr | provenance |  |
 | main.rs:5:25:5:46 | ...::get | main.rs:5:25:5:69 | ...::get(...) [Ok] | provenance | Src:MaD:6  |
 | main.rs:5:25:5:69 | ...::get(...) [Ok] | main.rs:5:25:6:17 | ... .unwrap() | provenance | MaD:11 |
 | main.rs:5:25:6:17 | ... .unwrap() | main.rs:5:25:7:15 | ... .text() [Ok] | provenance | MaD:13 |
@@ -30,17 +32,24 @@ edges
 | main.rs:47:16:47:45 | [...] [element, &ref] | main.rs:47:15:47:45 | &... [&ref, element, &ref] | provenance |  |
 | main.rs:47:23:47:35 | remote_string | main.rs:47:23:47:44 | remote_string.as_str() [&ref] | provenance | MaD:9 |
 | main.rs:47:23:47:44 | remote_string.as_str() [&ref] | main.rs:47:16:47:45 | [...] [element, &ref] | provenance |  |
-| main.rs:53:9:53:21 | remote_string | main.rs:59:48:59:60 | remote_string | provenance |  |
-| main.rs:53:9:53:21 | remote_string | main.rs:67:14:67:26 | remote_string | provenance |  |
-| main.rs:53:25:53:46 | ...::get | main.rs:53:25:53:69 | ...::get(...) [Ok] | provenance | Src:MaD:6  |
-| main.rs:53:25:53:69 | ...::get(...) [Ok] | main.rs:53:25:54:17 | ... .unwrap() | provenance | MaD:11 |
-| main.rs:53:25:54:17 | ... .unwrap() | main.rs:53:25:55:15 | ... .text() [Ok] | provenance | MaD:13 |
-| main.rs:53:25:55:15 | ... .text() [Ok] | main.rs:53:25:56:38 | ... .unwrap_or(...) | provenance | MaD:12 |
-| main.rs:53:25:56:38 | ... .unwrap_or(...) | main.rs:53:9:53:21 | remote_string | provenance |  |
-| main.rs:59:48:59:60 | remote_string | main.rs:59:48:59:69 | remote_string.as_str() [&ref] | provenance | MaD:9 |
-| main.rs:59:48:59:69 | remote_string.as_str() [&ref] | main.rs:59:19:59:46 | ...::new | provenance | MaD:5 Sink:MaD:5 |
-| main.rs:67:14:67:26 | remote_string | main.rs:67:14:67:35 | remote_string.as_str() [&ref] | provenance | MaD:9 |
-| main.rs:67:14:67:35 | remote_string.as_str() [&ref] | main.rs:67:10:67:12 | arg | provenance | MaD:4 Sink:MaD:4 |
+| main.rs:52:9:52:28 | concatenated_command | main.rs:53:18:53:37 | concatenated_command | provenance |  |
+| main.rs:52:40:52:69 | ...::format(...) | main.rs:52:40:52:69 | { ... } | provenance |  |
+| main.rs:52:40:52:69 | ...::must_use(...) | main.rs:52:9:52:28 | concatenated_command | provenance |  |
+| main.rs:52:40:52:69 | MacroExpr | main.rs:52:40:52:69 | ...::format(...) | provenance | MaD:14 |
+| main.rs:52:40:52:69 | { ... } | main.rs:52:40:52:69 | ...::must_use(...) | provenance | MaD:15 |
+| main.rs:53:18:53:37 | concatenated_command | main.rs:53:18:53:46 | concatenated_command.as_str() [&ref] | provenance | MaD:9 |
+| main.rs:53:18:53:46 | concatenated_command.as_str() [&ref] | main.rs:53:5:53:16 | ...::new | provenance | MaD:3 Sink:MaD:3 |
+| main.rs:59:9:59:21 | remote_string | main.rs:65:48:65:60 | remote_string | provenance |  |
+| main.rs:59:9:59:21 | remote_string | main.rs:73:14:73:26 | remote_string | provenance |  |
+| main.rs:59:25:59:46 | ...::get | main.rs:59:25:59:69 | ...::get(...) [Ok] | provenance | Src:MaD:6  |
+| main.rs:59:25:59:69 | ...::get(...) [Ok] | main.rs:59:25:60:17 | ... .unwrap() | provenance | MaD:11 |
+| main.rs:59:25:60:17 | ... .unwrap() | main.rs:59:25:61:15 | ... .text() [Ok] | provenance | MaD:13 |
+| main.rs:59:25:61:15 | ... .text() [Ok] | main.rs:59:25:62:38 | ... .unwrap_or(...) | provenance | MaD:12 |
+| main.rs:59:25:62:38 | ... .unwrap_or(...) | main.rs:59:9:59:21 | remote_string | provenance |  |
+| main.rs:65:48:65:60 | remote_string | main.rs:65:48:65:69 | remote_string.as_str() [&ref] | provenance | MaD:9 |
+| main.rs:65:48:65:69 | remote_string.as_str() [&ref] | main.rs:65:19:65:46 | ...::new | provenance | MaD:5 Sink:MaD:5 |
+| main.rs:73:14:73:26 | remote_string | main.rs:73:14:73:35 | remote_string.as_str() [&ref] | provenance | MaD:9 |
+| main.rs:73:14:73:35 | remote_string.as_str() [&ref] | main.rs:73:10:73:12 | arg | provenance | MaD:4 Sink:MaD:4 |
 models
 | 1 | Sink: <std::process::Command>::arg; Argument[0]; command-injection |
 | 2 | Sink: <std::process::Command>::args; Argument[0]; command-injection |
@@ -55,6 +64,8 @@ models
 | 11 | Summary: <core::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
 | 12 | Summary: <core::result::Result>::unwrap_or; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
 | 13 | Summary: <reqwest::blocking::response::Response>::text; Argument[self]; ReturnValue.Field[core::result::Result::Ok(0)]; taint |
+| 14 | Summary: alloc::fmt::format; Argument[0]; ReturnValue; taint |
+| 15 | Summary: core::hint::must_use; Argument[0]; ReturnValue; value |
 nodes
 | main.rs:4:9:4:18 | arg_string | semmle.label | arg_string |
 | main.rs:4:22:4:35 | ...::args | semmle.label | ...::args |
@@ -81,16 +92,24 @@ nodes
 | main.rs:47:16:47:45 | [...] [element, &ref] | semmle.label | [...] [element, &ref] |
 | main.rs:47:23:47:35 | remote_string | semmle.label | remote_string |
 | main.rs:47:23:47:44 | remote_string.as_str() [&ref] | semmle.label | remote_string.as_str() [&ref] |
-| main.rs:53:9:53:21 | remote_string | semmle.label | remote_string |
-| main.rs:53:25:53:46 | ...::get | semmle.label | ...::get |
-| main.rs:53:25:53:69 | ...::get(...) [Ok] | semmle.label | ...::get(...) [Ok] |
-| main.rs:53:25:54:17 | ... .unwrap() | semmle.label | ... .unwrap() |
-| main.rs:53:25:55:15 | ... .text() [Ok] | semmle.label | ... .text() [Ok] |
-| main.rs:53:25:56:38 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
-| main.rs:59:19:59:46 | ...::new | semmle.label | ...::new |
-| main.rs:59:48:59:60 | remote_string | semmle.label | remote_string |
-| main.rs:59:48:59:69 | remote_string.as_str() [&ref] | semmle.label | remote_string.as_str() [&ref] |
-| main.rs:67:10:67:12 | arg | semmle.label | arg |
-| main.rs:67:14:67:26 | remote_string | semmle.label | remote_string |
-| main.rs:67:14:67:35 | remote_string.as_str() [&ref] | semmle.label | remote_string.as_str() [&ref] |
+| main.rs:52:9:52:28 | concatenated_command | semmle.label | concatenated_command |
+| main.rs:52:40:52:69 | ...::format(...) | semmle.label | ...::format(...) |
+| main.rs:52:40:52:69 | ...::must_use(...) | semmle.label | ...::must_use(...) |
+| main.rs:52:40:52:69 | MacroExpr | semmle.label | MacroExpr |
+| main.rs:52:40:52:69 | { ... } | semmle.label | { ... } |
+| main.rs:53:5:53:16 | ...::new | semmle.label | ...::new |
+| main.rs:53:18:53:37 | concatenated_command | semmle.label | concatenated_command |
+| main.rs:53:18:53:46 | concatenated_command.as_str() [&ref] | semmle.label | concatenated_command.as_str() [&ref] |
+| main.rs:59:9:59:21 | remote_string | semmle.label | remote_string |
+| main.rs:59:25:59:46 | ...::get | semmle.label | ...::get |
+| main.rs:59:25:59:69 | ...::get(...) [Ok] | semmle.label | ...::get(...) [Ok] |
+| main.rs:59:25:60:17 | ... .unwrap() | semmle.label | ... .unwrap() |
+| main.rs:59:25:61:15 | ... .text() [Ok] | semmle.label | ... .text() [Ok] |
+| main.rs:59:25:62:38 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
+| main.rs:65:19:65:46 | ...::new | semmle.label | ...::new |
+| main.rs:65:48:65:60 | remote_string | semmle.label | remote_string |
+| main.rs:65:48:65:69 | remote_string.as_str() [&ref] | semmle.label | remote_string.as_str() [&ref] |
+| main.rs:73:10:73:12 | arg | semmle.label | arg |
+| main.rs:73:14:73:26 | remote_string | semmle.label | remote_string |
+| main.rs:73:14:73:35 | remote_string.as_str() [&ref] | semmle.label | remote_string.as_str() [&ref] |
 subpaths
diff --git a/rust/ql/test/query-tests/security/CWE-078/main.rs b/rust/ql/test/query-tests/security/CWE-078/main.rs
index eecf95cec33d..f81ec33fba3a 100644
--- a/rust/ql/test/query-tests/security/CWE-078/main.rs
+++ b/rust/ql/test/query-tests/security/CWE-078/main.rs
@@ -47,6 +47,12 @@ fn test_std_command_injection() {
         .args(&["-c", remote_string.as_str()]) // $ Alert[rust/command-line-injection]=remote1
         .output()
         .expect("failed");
+
+    // Remote input concatenated into a command
+    let concatenated_command = format!("sh -c echo {}", remote_string);
+    Command::new(concatenated_command.as_str()) // $ Alert[rust/command-line-injection]=remote1
+        .output()
+        .expect("failed");
 }
 
 async fn test_tokio_command_injection() {
@@ -72,4 +78,5 @@ async fn test_tokio_command_injection() {
 
 fn main() {
     test_std_command_injection();
+    test_tokio_command_injection();
 }

From bd564489a6d3b15ce01f8b1ce99bf163001ff7a1 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 13 Aug 2026 22:17:44 +0100
Subject: [PATCH 5/9] Rust: Add the examples as test cases.

---
 .../CWE-078/CommandInjection.expected         | 31 ++++++++++++++++++
 .../test/query-tests/security/CWE-078/main.rs | 32 +++++++++++++++++++
 2 files changed, 63 insertions(+)

diff --git a/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
index 21485f4e3a3b..71be73855bbd 100644
--- a/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
+++ b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
@@ -6,6 +6,8 @@
 | main.rs:53:5:53:16 | ...::new | main.rs:5:25:5:46 | ...::get | main.rs:53:5:53:16 | ...::new | This command line depends on a $@. | main.rs:5:25:5:46 | ...::get | user-provided value |
 | main.rs:65:19:65:46 | ...::new | main.rs:59:25:59:46 | ...::get | main.rs:65:19:65:46 | ...::new | This command line depends on a $@. | main.rs:59:25:59:46 | ...::get | user-provided value |
 | main.rs:73:10:73:12 | arg | main.rs:59:25:59:46 | ...::get | main.rs:73:10:73:12 | arg | This command line depends on a $@. | main.rs:59:25:59:46 | ...::get | user-provided value |
+| main.rs:86:14:86:16 | arg | main.rs:108:22:108:35 | ...::args | main.rs:86:14:86:16 | arg | This command line depends on a $@. | main.rs:108:22:108:35 | ...::args | user-provided value |
+| main.rs:100:18:100:20 | arg | main.rs:108:22:108:35 | ...::args | main.rs:100:18:100:20 | arg | This command line depends on a $@. | main.rs:108:22:108:35 | ...::args | user-provided value |
 edges
 | main.rs:4:9:4:18 | arg_string | main.rs:27:18:27:27 | arg_string | provenance |  |
 | main.rs:4:9:4:18 | arg_string | main.rs:40:14:40:23 | arg_string | provenance |  |
@@ -50,6 +52,20 @@ edges
 | main.rs:65:48:65:69 | remote_string.as_str() [&ref] | main.rs:65:19:65:46 | ...::new | provenance | MaD:5 Sink:MaD:5 |
 | main.rs:73:14:73:26 | remote_string | main.rs:73:14:73:35 | remote_string.as_str() [&ref] | provenance | MaD:9 |
 | main.rs:73:14:73:35 | remote_string.as_str() [&ref] | main.rs:73:10:73:12 | arg | provenance | MaD:4 Sink:MaD:4 |
+| main.rs:82:27:82:42 | ...: ... [&ref] | main.rs:86:18:86:27 | user_input [&ref] | provenance |  |
+| main.rs:86:18:86:27 | user_input [&ref] | main.rs:86:14:86:16 | arg | provenance | MaD:1 Sink:MaD:1 |
+| main.rs:95:27:95:40 | ...: ... [&ref] | main.rs:100:22:100:29 | filename [&ref] | provenance |  |
+| main.rs:100:22:100:29 | filename [&ref] | main.rs:100:18:100:20 | arg | provenance | MaD:1 Sink:MaD:1 |
+| main.rs:108:9:108:18 | arg_string | main.rs:112:39:112:48 | arg_string | provenance |  |
+| main.rs:108:9:108:18 | arg_string | main.rs:113:40:113:49 | arg_string | provenance |  |
+| main.rs:108:22:108:35 | ...::args | main.rs:108:22:108:37 | ...::args(...) [element] | provenance | Src:MaD:7  |
+| main.rs:108:22:108:37 | ...::args(...) [element] | main.rs:108:22:108:44 | ... .nth(...) [Some] | provenance | MaD:8 |
+| main.rs:108:22:108:44 | ... .nth(...) [Some] | main.rs:108:22:108:74 | ... .unwrap_or(...) | provenance | MaD:10 |
+| main.rs:108:22:108:74 | ... .unwrap_or(...) | main.rs:108:9:108:18 | arg_string | provenance |  |
+| main.rs:112:39:112:48 | arg_string | main.rs:112:39:112:57 | arg_string.as_str() [&ref] | provenance | MaD:9 |
+| main.rs:112:39:112:57 | arg_string.as_str() [&ref] | main.rs:82:27:82:42 | ...: ... [&ref] | provenance |  |
+| main.rs:113:40:113:49 | arg_string | main.rs:113:40:113:58 | arg_string.as_str() [&ref] | provenance | MaD:9 |
+| main.rs:113:40:113:58 | arg_string.as_str() [&ref] | main.rs:95:27:95:40 | ...: ... [&ref] | provenance |  |
 models
 | 1 | Sink: <std::process::Command>::arg; Argument[0]; command-injection |
 | 2 | Sink: <std::process::Command>::args; Argument[0]; command-injection |
@@ -112,4 +128,19 @@ nodes
 | main.rs:73:10:73:12 | arg | semmle.label | arg |
 | main.rs:73:14:73:26 | remote_string | semmle.label | remote_string |
 | main.rs:73:14:73:35 | remote_string.as_str() [&ref] | semmle.label | remote_string.as_str() [&ref] |
+| main.rs:82:27:82:42 | ...: ... [&ref] | semmle.label | ...: ... [&ref] |
+| main.rs:86:14:86:16 | arg | semmle.label | arg |
+| main.rs:86:18:86:27 | user_input [&ref] | semmle.label | user_input [&ref] |
+| main.rs:95:27:95:40 | ...: ... [&ref] | semmle.label | ...: ... [&ref] |
+| main.rs:100:18:100:20 | arg | semmle.label | arg |
+| main.rs:100:22:100:29 | filename [&ref] | semmle.label | filename [&ref] |
+| main.rs:108:9:108:18 | arg_string | semmle.label | arg_string |
+| main.rs:108:22:108:35 | ...::args | semmle.label | ...::args |
+| main.rs:108:22:108:37 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
+| main.rs:108:22:108:44 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
+| main.rs:108:22:108:74 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
+| main.rs:112:39:112:48 | arg_string | semmle.label | arg_string |
+| main.rs:112:39:112:57 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
+| main.rs:113:40:113:49 | arg_string | semmle.label | arg_string |
+| main.rs:113:40:113:58 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
 subpaths
diff --git a/rust/ql/test/query-tests/security/CWE-078/main.rs b/rust/ql/test/query-tests/security/CWE-078/main.rs
index f81ec33fba3a..6fc29ceb2104 100644
--- a/rust/ql/test/query-tests/security/CWE-078/main.rs
+++ b/rust/ql/test/query-tests/security/CWE-078/main.rs
@@ -76,7 +76,39 @@ async fn test_tokio_command_injection() {
         .expect("failed");
 }
 
+mod qhelp_example_bad {
+    use std::process::Command;
+
+    pub fn handle_request(user_input: &str) {
+        // BAD
+        Command::new("sh")
+            .arg("-c")
+            .arg(user_input) // $ Alert[rust/command-line-injection]=args2
+            .output()
+            .expect("failed to execute");
+    }
+}
+
+mod qhelp_example_good {
+    use std::process::Command;
+
+    pub fn handle_request(filename: &str) {
+        // GOOD
+        let allowed_names = ["report.pdf", "summary.txt", "data.csv"];
+        if allowed_names.contains(&filename) {
+            Command::new("cat")
+                .arg(filename) // $ SPURIOUS: Alert[rust/command-line-injection]=args2
+                .output()
+                .expect("failed to execute");
+        }
+    }
+}
+
 fn main() {
+    let arg_string = std::env::args().nth(1).unwrap_or(String::from("ls")); // $ Source=args2
+
     test_std_command_injection();
     test_tokio_command_injection();
+    qhelp_example_bad::handle_request(arg_string.as_str());
+    qhelp_example_good::handle_request(arg_string.as_str());
 }

From 35ccfb1e373b106db28c99029cd3c21d50abe450 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 18 Aug 2026 16:54:36 +0100
Subject: [PATCH 6/9] Rust: Accept changes to test .expected file, result of
 upgrades on main.

---
 .../CWE-078/CommandInjection.expected         | 76 +++++++++----------
 1 file changed, 36 insertions(+), 40 deletions(-)

diff --git a/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
index 71be73855bbd..396f31314dac 100644
--- a/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
+++ b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
@@ -1,36 +1,36 @@
 #select
-| main.rs:27:5:27:16 | ...::new | main.rs:4:22:4:35 | ...::args | main.rs:27:5:27:16 | ...::new | This command line depends on a $@. | main.rs:4:22:4:35 | ...::args | user-provided value |
-| main.rs:34:10:34:12 | arg | main.rs:5:25:5:46 | ...::get | main.rs:34:10:34:12 | arg | This command line depends on a $@. | main.rs:5:25:5:46 | ...::get | user-provided value |
-| main.rs:40:10:40:12 | arg | main.rs:4:22:4:35 | ...::args | main.rs:40:10:40:12 | arg | This command line depends on a $@. | main.rs:4:22:4:35 | ...::args | user-provided value |
-| main.rs:47:10:47:13 | args | main.rs:5:25:5:46 | ...::get | main.rs:47:10:47:13 | args | This command line depends on a $@. | main.rs:5:25:5:46 | ...::get | user-provided value |
-| main.rs:53:5:53:16 | ...::new | main.rs:5:25:5:46 | ...::get | main.rs:53:5:53:16 | ...::new | This command line depends on a $@. | main.rs:5:25:5:46 | ...::get | user-provided value |
-| main.rs:65:19:65:46 | ...::new | main.rs:59:25:59:46 | ...::get | main.rs:65:19:65:46 | ...::new | This command line depends on a $@. | main.rs:59:25:59:46 | ...::get | user-provided value |
-| main.rs:73:10:73:12 | arg | main.rs:59:25:59:46 | ...::get | main.rs:73:10:73:12 | arg | This command line depends on a $@. | main.rs:59:25:59:46 | ...::get | user-provided value |
-| main.rs:86:14:86:16 | arg | main.rs:108:22:108:35 | ...::args | main.rs:86:14:86:16 | arg | This command line depends on a $@. | main.rs:108:22:108:35 | ...::args | user-provided value |
-| main.rs:100:18:100:20 | arg | main.rs:108:22:108:35 | ...::args | main.rs:100:18:100:20 | arg | This command line depends on a $@. | main.rs:108:22:108:35 | ...::args | user-provided value |
+| main.rs:27:18:27:36 | arg_string.as_str() | main.rs:4:22:4:37 | ...::args(...) | main.rs:27:18:27:36 | arg_string.as_str() | This command line depends on a $@. | main.rs:4:22:4:37 | ...::args(...) | user-provided value |
+| main.rs:34:14:34:35 | remote_string.as_str() | main.rs:5:25:5:69 | ...::get(...) | main.rs:34:14:34:35 | remote_string.as_str() | This command line depends on a $@. | main.rs:5:25:5:69 | ...::get(...) | user-provided value |
+| main.rs:40:14:40:32 | arg_string.as_str() | main.rs:4:22:4:37 | ...::args(...) | main.rs:40:14:40:32 | arg_string.as_str() | This command line depends on a $@. | main.rs:4:22:4:37 | ...::args(...) | user-provided value |
+| main.rs:47:15:47:45 | &... | main.rs:5:25:5:69 | ...::get(...) | main.rs:47:15:47:45 | &... | This command line depends on a $@. | main.rs:5:25:5:69 | ...::get(...) | user-provided value |
+| main.rs:53:18:53:46 | concatenated_command.as_str() | main.rs:5:25:5:69 | ...::get(...) | main.rs:53:18:53:46 | concatenated_command.as_str() | This command line depends on a $@. | main.rs:5:25:5:69 | ...::get(...) | user-provided value |
+| main.rs:65:48:65:69 | remote_string.as_str() | main.rs:59:25:59:69 | ...::get(...) | main.rs:65:48:65:69 | remote_string.as_str() | This command line depends on a $@. | main.rs:59:25:59:69 | ...::get(...) | user-provided value |
+| main.rs:73:14:73:35 | remote_string.as_str() | main.rs:59:25:59:69 | ...::get(...) | main.rs:73:14:73:35 | remote_string.as_str() | This command line depends on a $@. | main.rs:59:25:59:69 | ...::get(...) | user-provided value |
+| main.rs:86:18:86:27 | user_input | main.rs:108:22:108:37 | ...::args(...) | main.rs:86:18:86:27 | user_input | This command line depends on a $@. | main.rs:108:22:108:37 | ...::args(...) | user-provided value |
+| main.rs:100:22:100:29 | filename | main.rs:108:22:108:37 | ...::args(...) | main.rs:100:22:100:29 | filename | This command line depends on a $@. | main.rs:108:22:108:37 | ...::args(...) | user-provided value |
 edges
 | main.rs:4:9:4:18 | arg_string | main.rs:27:18:27:27 | arg_string | provenance |  |
 | main.rs:4:9:4:18 | arg_string | main.rs:40:14:40:23 | arg_string | provenance |  |
-| main.rs:4:22:4:35 | ...::args | main.rs:4:22:4:37 | ...::args(...) [element] | provenance | Src:MaD:7  |
+| main.rs:4:22:4:37 | ...::args(...) | main.rs:4:22:4:37 | ...::args(...) [element] | provenance | Src:MaD:7  |
 | main.rs:4:22:4:37 | ...::args(...) [element] | main.rs:4:22:4:44 | ... .nth(...) [Some] | provenance | MaD:8 |
 | main.rs:4:22:4:44 | ... .nth(...) [Some] | main.rs:4:22:4:74 | ... .unwrap_or(...) | provenance | MaD:10 |
 | main.rs:4:22:4:74 | ... .unwrap_or(...) | main.rs:4:9:4:18 | arg_string | provenance |  |
 | main.rs:5:9:5:21 | remote_string | main.rs:34:14:34:26 | remote_string | provenance |  |
 | main.rs:5:9:5:21 | remote_string | main.rs:47:23:47:35 | remote_string | provenance |  |
 | main.rs:5:9:5:21 | remote_string | main.rs:52:40:52:69 | MacroExpr | provenance |  |
-| main.rs:5:25:5:46 | ...::get | main.rs:5:25:5:69 | ...::get(...) [Ok] | provenance | Src:MaD:6  |
+| main.rs:5:25:5:69 | ...::get(...) | main.rs:5:25:5:69 | ...::get(...) [Ok] | provenance | Src:MaD:6  |
 | main.rs:5:25:5:69 | ...::get(...) [Ok] | main.rs:5:25:6:17 | ... .unwrap() | provenance | MaD:11 |
 | main.rs:5:25:6:17 | ... .unwrap() | main.rs:5:25:7:15 | ... .text() [Ok] | provenance | MaD:13 |
 | main.rs:5:25:7:15 | ... .text() [Ok] | main.rs:5:25:8:38 | ... .unwrap_or(...) | provenance | MaD:12 |
 | main.rs:5:25:8:38 | ... .unwrap_or(...) | main.rs:5:9:5:21 | remote_string | provenance |  |
 | main.rs:27:18:27:27 | arg_string | main.rs:27:18:27:36 | arg_string.as_str() [&ref] | provenance | MaD:9 |
-| main.rs:27:18:27:36 | arg_string.as_str() [&ref] | main.rs:27:5:27:16 | ...::new | provenance | MaD:3 Sink:MaD:3 |
+| main.rs:27:18:27:36 | arg_string.as_str() [&ref] | main.rs:27:18:27:36 | arg_string.as_str() | provenance | Sink:MaD:3 |
 | main.rs:34:14:34:26 | remote_string | main.rs:34:14:34:35 | remote_string.as_str() [&ref] | provenance | MaD:9 |
-| main.rs:34:14:34:35 | remote_string.as_str() [&ref] | main.rs:34:10:34:12 | arg | provenance | MaD:1 Sink:MaD:1 |
+| main.rs:34:14:34:35 | remote_string.as_str() [&ref] | main.rs:34:14:34:35 | remote_string.as_str() | provenance | Sink:MaD:1 |
 | main.rs:40:14:40:23 | arg_string | main.rs:40:14:40:32 | arg_string.as_str() [&ref] | provenance | MaD:9 |
-| main.rs:40:14:40:32 | arg_string.as_str() [&ref] | main.rs:40:10:40:12 | arg | provenance | MaD:1 Sink:MaD:1 |
-| main.rs:47:15:47:45 | &... [&ref, element, &ref] | main.rs:47:10:47:13 | args | provenance | MaD:2 Sink:MaD:2 Sink:MaD:2 |
-| main.rs:47:15:47:45 | &... [&ref, element, &ref] | main.rs:47:10:47:13 | args | provenance | MaD:2 Sink:MaD:2 Sink:MaD:2 Sink:MaD:2 |
+| main.rs:40:14:40:32 | arg_string.as_str() [&ref] | main.rs:40:14:40:32 | arg_string.as_str() | provenance | Sink:MaD:1 |
+| main.rs:47:15:47:45 | &... [&ref, element, &ref] | main.rs:47:15:47:45 | &... | provenance | Sink:MaD:2 Sink:MaD:2 |
+| main.rs:47:15:47:45 | &... [&ref, element, &ref] | main.rs:47:15:47:45 | &... | provenance | Sink:MaD:2 Sink:MaD:2 Sink:MaD:2 |
 | main.rs:47:16:47:45 | [...] [element, &ref] | main.rs:47:15:47:45 | &... [&ref, element, &ref] | provenance |  |
 | main.rs:47:23:47:35 | remote_string | main.rs:47:23:47:44 | remote_string.as_str() [&ref] | provenance | MaD:9 |
 | main.rs:47:23:47:44 | remote_string.as_str() [&ref] | main.rs:47:16:47:45 | [...] [element, &ref] | provenance |  |
@@ -40,25 +40,23 @@ edges
 | main.rs:52:40:52:69 | MacroExpr | main.rs:52:40:52:69 | ...::format(...) | provenance | MaD:14 |
 | main.rs:52:40:52:69 | { ... } | main.rs:52:40:52:69 | ...::must_use(...) | provenance | MaD:15 |
 | main.rs:53:18:53:37 | concatenated_command | main.rs:53:18:53:46 | concatenated_command.as_str() [&ref] | provenance | MaD:9 |
-| main.rs:53:18:53:46 | concatenated_command.as_str() [&ref] | main.rs:53:5:53:16 | ...::new | provenance | MaD:3 Sink:MaD:3 |
+| main.rs:53:18:53:46 | concatenated_command.as_str() [&ref] | main.rs:53:18:53:46 | concatenated_command.as_str() | provenance | Sink:MaD:3 |
 | main.rs:59:9:59:21 | remote_string | main.rs:65:48:65:60 | remote_string | provenance |  |
 | main.rs:59:9:59:21 | remote_string | main.rs:73:14:73:26 | remote_string | provenance |  |
-| main.rs:59:25:59:46 | ...::get | main.rs:59:25:59:69 | ...::get(...) [Ok] | provenance | Src:MaD:6  |
+| main.rs:59:25:59:69 | ...::get(...) | main.rs:59:25:59:69 | ...::get(...) [Ok] | provenance | Src:MaD:6  |
 | main.rs:59:25:59:69 | ...::get(...) [Ok] | main.rs:59:25:60:17 | ... .unwrap() | provenance | MaD:11 |
 | main.rs:59:25:60:17 | ... .unwrap() | main.rs:59:25:61:15 | ... .text() [Ok] | provenance | MaD:13 |
 | main.rs:59:25:61:15 | ... .text() [Ok] | main.rs:59:25:62:38 | ... .unwrap_or(...) | provenance | MaD:12 |
 | main.rs:59:25:62:38 | ... .unwrap_or(...) | main.rs:59:9:59:21 | remote_string | provenance |  |
 | main.rs:65:48:65:60 | remote_string | main.rs:65:48:65:69 | remote_string.as_str() [&ref] | provenance | MaD:9 |
-| main.rs:65:48:65:69 | remote_string.as_str() [&ref] | main.rs:65:19:65:46 | ...::new | provenance | MaD:5 Sink:MaD:5 |
+| main.rs:65:48:65:69 | remote_string.as_str() [&ref] | main.rs:65:48:65:69 | remote_string.as_str() | provenance | Sink:MaD:5 |
 | main.rs:73:14:73:26 | remote_string | main.rs:73:14:73:35 | remote_string.as_str() [&ref] | provenance | MaD:9 |
-| main.rs:73:14:73:35 | remote_string.as_str() [&ref] | main.rs:73:10:73:12 | arg | provenance | MaD:4 Sink:MaD:4 |
-| main.rs:82:27:82:42 | ...: ... [&ref] | main.rs:86:18:86:27 | user_input [&ref] | provenance |  |
-| main.rs:86:18:86:27 | user_input [&ref] | main.rs:86:14:86:16 | arg | provenance | MaD:1 Sink:MaD:1 |
-| main.rs:95:27:95:40 | ...: ... [&ref] | main.rs:100:22:100:29 | filename [&ref] | provenance |  |
-| main.rs:100:22:100:29 | filename [&ref] | main.rs:100:18:100:20 | arg | provenance | MaD:1 Sink:MaD:1 |
+| main.rs:73:14:73:35 | remote_string.as_str() [&ref] | main.rs:73:14:73:35 | remote_string.as_str() | provenance | Sink:MaD:4 |
+| main.rs:82:27:82:42 | ...: ... [&ref] | main.rs:86:18:86:27 | user_input | provenance | Sink:MaD:1 |
+| main.rs:95:27:95:40 | ...: ... [&ref] | main.rs:100:22:100:29 | filename | provenance | Sink:MaD:1 |
 | main.rs:108:9:108:18 | arg_string | main.rs:112:39:112:48 | arg_string | provenance |  |
 | main.rs:108:9:108:18 | arg_string | main.rs:113:40:113:49 | arg_string | provenance |  |
-| main.rs:108:22:108:35 | ...::args | main.rs:108:22:108:37 | ...::args(...) [element] | provenance | Src:MaD:7  |
+| main.rs:108:22:108:37 | ...::args(...) | main.rs:108:22:108:37 | ...::args(...) [element] | provenance | Src:MaD:7  |
 | main.rs:108:22:108:37 | ...::args(...) [element] | main.rs:108:22:108:44 | ... .nth(...) [Some] | provenance | MaD:8 |
 | main.rs:108:22:108:44 | ... .nth(...) [Some] | main.rs:108:22:108:74 | ... .unwrap_or(...) | provenance | MaD:10 |
 | main.rs:108:22:108:74 | ... .unwrap_or(...) | main.rs:108:9:108:18 | arg_string | provenance |  |
@@ -84,26 +82,26 @@ models
 | 15 | Summary: core::hint::must_use; Argument[0]; ReturnValue; value |
 nodes
 | main.rs:4:9:4:18 | arg_string | semmle.label | arg_string |
-| main.rs:4:22:4:35 | ...::args | semmle.label | ...::args |
+| main.rs:4:22:4:37 | ...::args(...) | semmle.label | ...::args(...) |
 | main.rs:4:22:4:37 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
 | main.rs:4:22:4:44 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
 | main.rs:4:22:4:74 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
 | main.rs:5:9:5:21 | remote_string | semmle.label | remote_string |
-| main.rs:5:25:5:46 | ...::get | semmle.label | ...::get |
+| main.rs:5:25:5:69 | ...::get(...) | semmle.label | ...::get(...) |
 | main.rs:5:25:5:69 | ...::get(...) [Ok] | semmle.label | ...::get(...) [Ok] |
 | main.rs:5:25:6:17 | ... .unwrap() | semmle.label | ... .unwrap() |
 | main.rs:5:25:7:15 | ... .text() [Ok] | semmle.label | ... .text() [Ok] |
 | main.rs:5:25:8:38 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
-| main.rs:27:5:27:16 | ...::new | semmle.label | ...::new |
 | main.rs:27:18:27:27 | arg_string | semmle.label | arg_string |
+| main.rs:27:18:27:36 | arg_string.as_str() | semmle.label | arg_string.as_str() |
 | main.rs:27:18:27:36 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
-| main.rs:34:10:34:12 | arg | semmle.label | arg |
 | main.rs:34:14:34:26 | remote_string | semmle.label | remote_string |
+| main.rs:34:14:34:35 | remote_string.as_str() | semmle.label | remote_string.as_str() |
 | main.rs:34:14:34:35 | remote_string.as_str() [&ref] | semmle.label | remote_string.as_str() [&ref] |
-| main.rs:40:10:40:12 | arg | semmle.label | arg |
 | main.rs:40:14:40:23 | arg_string | semmle.label | arg_string |
+| main.rs:40:14:40:32 | arg_string.as_str() | semmle.label | arg_string.as_str() |
 | main.rs:40:14:40:32 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
-| main.rs:47:10:47:13 | args | semmle.label | args |
+| main.rs:47:15:47:45 | &... | semmle.label | &... |
 | main.rs:47:15:47:45 | &... [&ref, element, &ref] | semmle.label | &... [&ref, element, &ref] |
 | main.rs:47:16:47:45 | [...] [element, &ref] | semmle.label | [...] [element, &ref] |
 | main.rs:47:23:47:35 | remote_string | semmle.label | remote_string |
@@ -113,29 +111,27 @@ nodes
 | main.rs:52:40:52:69 | ...::must_use(...) | semmle.label | ...::must_use(...) |
 | main.rs:52:40:52:69 | MacroExpr | semmle.label | MacroExpr |
 | main.rs:52:40:52:69 | { ... } | semmle.label | { ... } |
-| main.rs:53:5:53:16 | ...::new | semmle.label | ...::new |
 | main.rs:53:18:53:37 | concatenated_command | semmle.label | concatenated_command |
+| main.rs:53:18:53:46 | concatenated_command.as_str() | semmle.label | concatenated_command.as_str() |
 | main.rs:53:18:53:46 | concatenated_command.as_str() [&ref] | semmle.label | concatenated_command.as_str() [&ref] |
 | main.rs:59:9:59:21 | remote_string | semmle.label | remote_string |
-| main.rs:59:25:59:46 | ...::get | semmle.label | ...::get |
+| main.rs:59:25:59:69 | ...::get(...) | semmle.label | ...::get(...) |
 | main.rs:59:25:59:69 | ...::get(...) [Ok] | semmle.label | ...::get(...) [Ok] |
 | main.rs:59:25:60:17 | ... .unwrap() | semmle.label | ... .unwrap() |
 | main.rs:59:25:61:15 | ... .text() [Ok] | semmle.label | ... .text() [Ok] |
 | main.rs:59:25:62:38 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
-| main.rs:65:19:65:46 | ...::new | semmle.label | ...::new |
 | main.rs:65:48:65:60 | remote_string | semmle.label | remote_string |
+| main.rs:65:48:65:69 | remote_string.as_str() | semmle.label | remote_string.as_str() |
 | main.rs:65:48:65:69 | remote_string.as_str() [&ref] | semmle.label | remote_string.as_str() [&ref] |
-| main.rs:73:10:73:12 | arg | semmle.label | arg |
 | main.rs:73:14:73:26 | remote_string | semmle.label | remote_string |
+| main.rs:73:14:73:35 | remote_string.as_str() | semmle.label | remote_string.as_str() |
 | main.rs:73:14:73:35 | remote_string.as_str() [&ref] | semmle.label | remote_string.as_str() [&ref] |
 | main.rs:82:27:82:42 | ...: ... [&ref] | semmle.label | ...: ... [&ref] |
-| main.rs:86:14:86:16 | arg | semmle.label | arg |
-| main.rs:86:18:86:27 | user_input [&ref] | semmle.label | user_input [&ref] |
+| main.rs:86:18:86:27 | user_input | semmle.label | user_input |
 | main.rs:95:27:95:40 | ...: ... [&ref] | semmle.label | ...: ... [&ref] |
-| main.rs:100:18:100:20 | arg | semmle.label | arg |
-| main.rs:100:22:100:29 | filename [&ref] | semmle.label | filename [&ref] |
+| main.rs:100:22:100:29 | filename | semmle.label | filename |
 | main.rs:108:9:108:18 | arg_string | semmle.label | arg_string |
-| main.rs:108:22:108:35 | ...::args | semmle.label | ...::args |
+| main.rs:108:22:108:37 | ...::args(...) | semmle.label | ...::args(...) |
 | main.rs:108:22:108:37 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
 | main.rs:108:22:108:44 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
 | main.rs:108:22:108:74 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |

From 1b3c87087b10444859c02221bab2441d60d8a76c Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 18 Aug 2026 11:22:33 +0100
Subject: [PATCH 7/9] Rust: Add more test cases for barrier guards.

---
 .../CWE-078/CommandInjection.expected         | 72 +++++++++++++------
 .../test/query-tests/security/CWE-078/main.rs | 31 ++++++++
 2 files changed, 82 insertions(+), 21 deletions(-)

diff --git a/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
index 396f31314dac..b618fbeeccee 100644
--- a/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
+++ b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
@@ -6,8 +6,16 @@
 | main.rs:53:18:53:46 | concatenated_command.as_str() | main.rs:5:25:5:69 | ...::get(...) | main.rs:53:18:53:46 | concatenated_command.as_str() | This command line depends on a $@. | main.rs:5:25:5:69 | ...::get(...) | user-provided value |
 | main.rs:65:48:65:69 | remote_string.as_str() | main.rs:59:25:59:69 | ...::get(...) | main.rs:65:48:65:69 | remote_string.as_str() | This command line depends on a $@. | main.rs:59:25:59:69 | ...::get(...) | user-provided value |
 | main.rs:73:14:73:35 | remote_string.as_str() | main.rs:59:25:59:69 | ...::get(...) | main.rs:73:14:73:35 | remote_string.as_str() | This command line depends on a $@. | main.rs:59:25:59:69 | ...::get(...) | user-provided value |
-| main.rs:86:18:86:27 | user_input | main.rs:108:22:108:37 | ...::args(...) | main.rs:86:18:86:27 | user_input | This command line depends on a $@. | main.rs:108:22:108:37 | ...::args(...) | user-provided value |
-| main.rs:100:22:100:29 | filename | main.rs:108:22:108:37 | ...::args(...) | main.rs:100:22:100:29 | filename | This command line depends on a $@. | main.rs:108:22:108:37 | ...::args(...) | user-provided value |
+| main.rs:86:18:86:27 | user_input | main.rs:138:22:138:37 | ...::args(...) | main.rs:86:18:86:27 | user_input | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
+| main.rs:100:22:100:29 | filename | main.rs:138:22:138:37 | ...::args(...) | main.rs:100:22:100:29 | filename | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
+| main.rs:111:22:111:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:111:22:111:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
+| main.rs:113:22:113:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:113:22:113:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
+| main.rs:119:22:119:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:119:22:119:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
+| main.rs:121:22:121:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:121:22:121:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
+| main.rs:125:22:125:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:125:22:125:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
+| main.rs:127:22:127:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:127:22:127:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
+| main.rs:131:22:131:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:131:22:131:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
+| main.rs:133:22:133:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:133:22:133:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
 edges
 | main.rs:4:9:4:18 | arg_string | main.rs:27:18:27:27 | arg_string | provenance |  |
 | main.rs:4:9:4:18 | arg_string | main.rs:40:14:40:23 | arg_string | provenance |  |
@@ -54,16 +62,27 @@ edges
 | main.rs:73:14:73:35 | remote_string.as_str() [&ref] | main.rs:73:14:73:35 | remote_string.as_str() | provenance | Sink:MaD:4 |
 | main.rs:82:27:82:42 | ...: ... [&ref] | main.rs:86:18:86:27 | user_input | provenance | Sink:MaD:1 |
 | main.rs:95:27:95:40 | ...: ... [&ref] | main.rs:100:22:100:29 | filename | provenance | Sink:MaD:1 |
-| main.rs:108:9:108:18 | arg_string | main.rs:112:39:112:48 | arg_string | provenance |  |
-| main.rs:108:9:108:18 | arg_string | main.rs:113:40:113:49 | arg_string | provenance |  |
-| main.rs:108:22:108:37 | ...::args(...) | main.rs:108:22:108:37 | ...::args(...) [element] | provenance | Src:MaD:7  |
-| main.rs:108:22:108:37 | ...::args(...) [element] | main.rs:108:22:108:44 | ... .nth(...) [Some] | provenance | MaD:8 |
-| main.rs:108:22:108:44 | ... .nth(...) [Some] | main.rs:108:22:108:74 | ... .unwrap_or(...) | provenance | MaD:10 |
-| main.rs:108:22:108:74 | ... .unwrap_or(...) | main.rs:108:9:108:18 | arg_string | provenance |  |
-| main.rs:112:39:112:48 | arg_string | main.rs:112:39:112:57 | arg_string.as_str() [&ref] | provenance | MaD:9 |
-| main.rs:112:39:112:57 | arg_string.as_str() [&ref] | main.rs:82:27:82:42 | ...: ... [&ref] | provenance |  |
-| main.rs:113:40:113:49 | arg_string | main.rs:113:40:113:58 | arg_string.as_str() [&ref] | provenance | MaD:9 |
-| main.rs:113:40:113:58 | arg_string.as_str() [&ref] | main.rs:95:27:95:40 | ...: ... [&ref] | provenance |  |
+| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:111:22:111:28 | command | provenance | Sink:MaD:3 |
+| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:113:22:113:28 | command | provenance | Sink:MaD:3 |
+| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:119:22:119:28 | command | provenance | Sink:MaD:3 |
+| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:121:22:121:28 | command | provenance | Sink:MaD:3 |
+| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:125:22:125:28 | command | provenance | Sink:MaD:3 |
+| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:127:22:127:28 | command | provenance | Sink:MaD:3 |
+| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:131:22:131:28 | command | provenance | Sink:MaD:3 |
+| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:133:22:133:28 | command | provenance | Sink:MaD:3 |
+| main.rs:138:9:138:18 | arg_string | main.rs:142:39:142:48 | arg_string | provenance |  |
+| main.rs:138:9:138:18 | arg_string | main.rs:143:40:143:49 | arg_string | provenance |  |
+| main.rs:138:9:138:18 | arg_string | main.rs:144:31:144:40 | arg_string | provenance |  |
+| main.rs:138:22:138:37 | ...::args(...) | main.rs:138:22:138:37 | ...::args(...) [element] | provenance | Src:MaD:7  |
+| main.rs:138:22:138:37 | ...::args(...) [element] | main.rs:138:22:138:44 | ... .nth(...) [Some] | provenance | MaD:8 |
+| main.rs:138:22:138:44 | ... .nth(...) [Some] | main.rs:138:22:138:74 | ... .unwrap_or(...) | provenance | MaD:10 |
+| main.rs:138:22:138:74 | ... .unwrap_or(...) | main.rs:138:9:138:18 | arg_string | provenance |  |
+| main.rs:142:39:142:48 | arg_string | main.rs:142:39:142:57 | arg_string.as_str() [&ref] | provenance | MaD:9 |
+| main.rs:142:39:142:57 | arg_string.as_str() [&ref] | main.rs:82:27:82:42 | ...: ... [&ref] | provenance |  |
+| main.rs:143:40:143:49 | arg_string | main.rs:143:40:143:58 | arg_string.as_str() [&ref] | provenance | MaD:9 |
+| main.rs:143:40:143:58 | arg_string.as_str() [&ref] | main.rs:95:27:95:40 | ...: ... [&ref] | provenance |  |
+| main.rs:144:31:144:40 | arg_string | main.rs:144:31:144:49 | arg_string.as_str() [&ref] | provenance | MaD:9 |
+| main.rs:144:31:144:49 | arg_string.as_str() [&ref] | main.rs:107:30:107:42 | ...: ... [&ref] | provenance |  |
 models
 | 1 | Sink: <std::process::Command>::arg; Argument[0]; command-injection |
 | 2 | Sink: <std::process::Command>::args; Argument[0]; command-injection |
@@ -130,13 +149,24 @@ nodes
 | main.rs:86:18:86:27 | user_input | semmle.label | user_input |
 | main.rs:95:27:95:40 | ...: ... [&ref] | semmle.label | ...: ... [&ref] |
 | main.rs:100:22:100:29 | filename | semmle.label | filename |
-| main.rs:108:9:108:18 | arg_string | semmle.label | arg_string |
-| main.rs:108:22:108:37 | ...::args(...) | semmle.label | ...::args(...) |
-| main.rs:108:22:108:37 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
-| main.rs:108:22:108:44 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
-| main.rs:108:22:108:74 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
-| main.rs:112:39:112:48 | arg_string | semmle.label | arg_string |
-| main.rs:112:39:112:57 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
-| main.rs:113:40:113:49 | arg_string | semmle.label | arg_string |
-| main.rs:113:40:113:58 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
+| main.rs:107:30:107:42 | ...: ... [&ref] | semmle.label | ...: ... [&ref] |
+| main.rs:111:22:111:28 | command | semmle.label | command |
+| main.rs:113:22:113:28 | command | semmle.label | command |
+| main.rs:119:22:119:28 | command | semmle.label | command |
+| main.rs:121:22:121:28 | command | semmle.label | command |
+| main.rs:125:22:125:28 | command | semmle.label | command |
+| main.rs:127:22:127:28 | command | semmle.label | command |
+| main.rs:131:22:131:28 | command | semmle.label | command |
+| main.rs:133:22:133:28 | command | semmle.label | command |
+| main.rs:138:9:138:18 | arg_string | semmle.label | arg_string |
+| main.rs:138:22:138:37 | ...::args(...) | semmle.label | ...::args(...) |
+| main.rs:138:22:138:37 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
+| main.rs:138:22:138:44 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
+| main.rs:138:22:138:74 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
+| main.rs:142:39:142:48 | arg_string | semmle.label | arg_string |
+| main.rs:142:39:142:57 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
+| main.rs:143:40:143:49 | arg_string | semmle.label | arg_string |
+| main.rs:143:40:143:58 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
+| main.rs:144:31:144:40 | arg_string | semmle.label | arg_string |
+| main.rs:144:31:144:49 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
 subpaths
diff --git a/rust/ql/test/query-tests/security/CWE-078/main.rs b/rust/ql/test/query-tests/security/CWE-078/main.rs
index 6fc29ceb2104..7a422af26d38 100644
--- a/rust/ql/test/query-tests/security/CWE-078/main.rs
+++ b/rust/ql/test/query-tests/security/CWE-078/main.rs
@@ -104,6 +104,36 @@ mod qhelp_example_good {
     }
 }
 
+fn test_allowlist_sanitizers(command: &str) {
+    let allowed_commands_array = ["cat", "git", "ls"];
+
+    if allowed_commands_array.contains(&command) {
+        Command::new(command).output().expect("failed"); // $ SPURIOUS: Alert[rust/command-line-injection]=args2
+    } else {
+        Command::new(command).output().expect("failed"); // $ Alert[rust/command-line-injection]=args2
+    }
+
+    let allowed_commands_vec = vec!["cat", "git", "ls"];
+
+    if allowed_commands_vec.contains(&command) {
+        Command::new(command).output().expect("failed"); // $ SPURIOUS: Alert[rust/command-line-injection]=args2
+    } else {
+        Command::new(command).output().expect("failed"); // $ Alert[rust/command-line-injection]=args2
+    }
+
+    if command == "ls" {
+        Command::new(command).output().expect("failed"); // $ SPURIOUS: Alert[rust/command-line-injection]=args2
+    } else {
+        Command::new(command).output().expect("failed"); // $ Alert[rust/command-line-injection]=args2
+    }
+
+    if command != "ls" {
+        Command::new(command).output().expect("failed"); // $ Alert[rust/command-line-injection]=args2
+    } else {
+        Command::new(command).output().expect("failed"); // $ SPURIOUS: Alert[rust/command-line-injection]=args2
+    }
+}
+
 fn main() {
     let arg_string = std::env::args().nth(1).unwrap_or(String::from("ls")); // $ Source=args2
 
@@ -111,4 +141,5 @@ fn main() {
     test_tokio_command_injection();
     qhelp_example_bad::handle_request(arg_string.as_str());
     qhelp_example_good::handle_request(arg_string.as_str());
+    test_allowlist_sanitizers(arg_string.as_str());
 }

From 1a8b5b5ea8d7862d7cab4766033addc3a0f630ea Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 18 Aug 2026 11:26:56 +0100
Subject: [PATCH 8/9] Rust: Add barrier guards to the query.

---
 .../security/CommandInjectionExtensions.qll   | 58 +++++++++++++++++++
 .../CWE-078/CommandInjection.expected         |  9 ---
 .../test/query-tests/security/CWE-078/main.rs |  6 +-
 3 files changed, 61 insertions(+), 12 deletions(-)

diff --git a/rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll b/rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll
index 7e0150d53f66..2abcec6eb6f9 100644
--- a/rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll
+++ b/rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll
@@ -61,4 +61,62 @@ module CommandInjection {
 
   private class FieldlessEnumTypeBarrier extends Barrier instanceof Barriers::FieldlessEnumTypeBarrier
   { }
+
+  /**
+   * A sanitizer guard for command injection vulnerabilities.
+   */
+  class SanitizerGuard extends Barrier {
+    SanitizerGuard() { this = DataFlow::BarrierGuard<sanitizerGuard/3>::getABarrierNode() }
+  }
+}
+
+private predicate sanitizerGuard(AstNode g, Expr e, boolean branch) {
+  g.(SanitizerGuard::Range).checks(e, branch)
+}
+
+/**
+ * Provides a class for modeling new command injection safety checks.
+ */
+module SanitizerGuard {
+  /**
+   * A data-flow node that checks whether a command is safe.
+   */
+  abstract class Range extends AstNode {
+    /**
+     * Holds if this guard validates `e` upon evaluating to `branch`.
+     */
+    abstract predicate checks(Expr e, boolean branch);
+  }
+}
+
+/**
+ * A successful membership check against a (presumed) command allowlist. For example:
+ * ```
+ * if allowlist.contains(&commmand) { ... }
+ * ```
+ */
+private class AllowlistContainsCheck extends SanitizerGuard::Range, MethodCall {
+  AllowlistContainsCheck() { this.getStaticTarget().getName().getText() = "contains" }
+
+  override predicate checks(Expr e, boolean branch) {
+    e.getParentNode*() = this.getPositionalArgument(0) and
+    branch = true
+  }
+}
+
+/**
+ * An equality check against a (presumed) allowed command value. For example:
+ * ```
+ * if command == "ls" { ... }
+ * ```
+ */
+private class AllowlistEqualityCheck extends SanitizerGuard::Range, EqualityOperation {
+  override predicate checks(Expr e, boolean branch) {
+    e = this.getAnOperand() and
+    (
+      this instanceof EqualsOperation and branch = true
+      or
+      this instanceof NotEqualsOperation and branch = false
+    )
+  }
 }
diff --git a/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
index b618fbeeccee..be6128cef5d0 100644
--- a/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
+++ b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected
@@ -10,12 +10,9 @@
 | main.rs:100:22:100:29 | filename | main.rs:138:22:138:37 | ...::args(...) | main.rs:100:22:100:29 | filename | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
 | main.rs:111:22:111:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:111:22:111:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
 | main.rs:113:22:113:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:113:22:113:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
-| main.rs:119:22:119:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:119:22:119:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
 | main.rs:121:22:121:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:121:22:121:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
-| main.rs:125:22:125:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:125:22:125:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
 | main.rs:127:22:127:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:127:22:127:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
 | main.rs:131:22:131:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:131:22:131:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
-| main.rs:133:22:133:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:133:22:133:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
 edges
 | main.rs:4:9:4:18 | arg_string | main.rs:27:18:27:27 | arg_string | provenance |  |
 | main.rs:4:9:4:18 | arg_string | main.rs:40:14:40:23 | arg_string | provenance |  |
@@ -64,12 +61,9 @@ edges
 | main.rs:95:27:95:40 | ...: ... [&ref] | main.rs:100:22:100:29 | filename | provenance | Sink:MaD:1 |
 | main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:111:22:111:28 | command | provenance | Sink:MaD:3 |
 | main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:113:22:113:28 | command | provenance | Sink:MaD:3 |
-| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:119:22:119:28 | command | provenance | Sink:MaD:3 |
 | main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:121:22:121:28 | command | provenance | Sink:MaD:3 |
-| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:125:22:125:28 | command | provenance | Sink:MaD:3 |
 | main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:127:22:127:28 | command | provenance | Sink:MaD:3 |
 | main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:131:22:131:28 | command | provenance | Sink:MaD:3 |
-| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:133:22:133:28 | command | provenance | Sink:MaD:3 |
 | main.rs:138:9:138:18 | arg_string | main.rs:142:39:142:48 | arg_string | provenance |  |
 | main.rs:138:9:138:18 | arg_string | main.rs:143:40:143:49 | arg_string | provenance |  |
 | main.rs:138:9:138:18 | arg_string | main.rs:144:31:144:40 | arg_string | provenance |  |
@@ -152,12 +146,9 @@ nodes
 | main.rs:107:30:107:42 | ...: ... [&ref] | semmle.label | ...: ... [&ref] |
 | main.rs:111:22:111:28 | command | semmle.label | command |
 | main.rs:113:22:113:28 | command | semmle.label | command |
-| main.rs:119:22:119:28 | command | semmle.label | command |
 | main.rs:121:22:121:28 | command | semmle.label | command |
-| main.rs:125:22:125:28 | command | semmle.label | command |
 | main.rs:127:22:127:28 | command | semmle.label | command |
 | main.rs:131:22:131:28 | command | semmle.label | command |
-| main.rs:133:22:133:28 | command | semmle.label | command |
 | main.rs:138:9:138:18 | arg_string | semmle.label | arg_string |
 | main.rs:138:22:138:37 | ...::args(...) | semmle.label | ...::args(...) |
 | main.rs:138:22:138:37 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
diff --git a/rust/ql/test/query-tests/security/CWE-078/main.rs b/rust/ql/test/query-tests/security/CWE-078/main.rs
index 7a422af26d38..f2d8ac4ee994 100644
--- a/rust/ql/test/query-tests/security/CWE-078/main.rs
+++ b/rust/ql/test/query-tests/security/CWE-078/main.rs
@@ -116,13 +116,13 @@ fn test_allowlist_sanitizers(command: &str) {
     let allowed_commands_vec = vec!["cat", "git", "ls"];
 
     if allowed_commands_vec.contains(&command) {
-        Command::new(command).output().expect("failed"); // $ SPURIOUS: Alert[rust/command-line-injection]=args2
+        Command::new(command).output().expect("failed");
     } else {
         Command::new(command).output().expect("failed"); // $ Alert[rust/command-line-injection]=args2
     }
 
     if command == "ls" {
-        Command::new(command).output().expect("failed"); // $ SPURIOUS: Alert[rust/command-line-injection]=args2
+        Command::new(command).output().expect("failed");
     } else {
         Command::new(command).output().expect("failed"); // $ Alert[rust/command-line-injection]=args2
     }
@@ -130,7 +130,7 @@ fn test_allowlist_sanitizers(command: &str) {
     if command != "ls" {
         Command::new(command).output().expect("failed"); // $ Alert[rust/command-line-injection]=args2
     } else {
-        Command::new(command).output().expect("failed"); // $ SPURIOUS: Alert[rust/command-line-injection]=args2
+        Command::new(command).output().expect("failed");
     }
 }
 

From 9fc84bfc329771ecfbc8e63dc19c78d7c8489dbf Mon Sep 17 00:00:00 2001
From: Chaitanya Mangalagiri <chmang@microsoft.com>
Date: Sat, 22 Aug 2026 15:30:19 -0700
Subject: [PATCH 9/9] Rust: Clarify comment in CommandInjectionGood.rs example
 per review suggestion

---
 rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs b/rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs
index bb720d39d03e..9892c47fda21 100644
--- a/rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs
+++ b/rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs
@@ -1,8 +1,7 @@
 use std::process::Command;
 
 fn handle_request(filename: &str) {
-    // GOOD: use a fixed command with the user input as a separate argument,
-    // avoiding shell interpretation
+    // GOOD: user input is checked against an allowlist before passing into a shell command
     let allowed_names = ["report.pdf", "summary.txt", "data.csv"];
     if allowed_names.contains(&filename) {
         Command::new("cat")