rules:
- id: dangerous-subinterpreters-run-string
  patterns:
  - pattern: |
      _xxsubinterpreters.run_string($ID, $PAYLOAD, ...)
  - pattern-not: |
      _xxsubinterpreters.run_string($ID, "...", ...)
  message: >-
    Found dynamic content in `run_string`.
    This is dangerous if external data can reach this function call because it allows
    a malicious actor to run arbitrary Python code.
    Ensure no external data reaches here.
  metadata:
    cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
    owasp: 'A1: Injection'
    references:
    - https://bugs.python.org/issue43472
    category: security
    technology:
    - python
  severity: WARNING
  languages:
  - python