The os/exec standard library package. exec.Command and exec.CommandContext are command injection sinks when any argument comes from user-controlled input. Most dangerous with shell=true-equivalent patterns.
.Command().CommandContext().Command()SinkCommand(name string, arg ...string) *Cmd
Creates Cmd to run name with args. name and any arg are injection sinks.
0.CommandContext()SinkCommandContext(ctx context.Context, name string, arg ...string) *Cmd
Like Command but with context for cancellation. Same injection risk.
1| FQN | Field | |
|---|---|---|
| os/exec | fqns[0] | |
| os/exec.Cmd | fqns[1] | |
| exec.* | patterns |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
// standard library — no go.mod entry required
from codepathfinder.go_rule import GoOSExec