rules:
  - id: args-os
    message: >-
      args_os should not be used for security operations. From the docs:
      "The first element is traditionally the path of the executable, but it
      can be set to arbitrary text, and might not even exist. This means this
      property should not be relied upon for security purposes."
    pattern: "std::env::args_os()"
    metadata:
      references:
        - https://doc.rust-lang.org/stable/std/env/fn.args_os.html
      technology:
        - rust
      category: security
      cwe: "CWE-807: Reliance on Untrusted Inputs in a Security Decision"
      confidence: HIGH
      likelihood: LOW
      impact: LOW
      subcategory: audit
    languages: [rust]
    severity: INFO