Finding an eval() call in a Python repository is easy. Understanding where its argument comes from takes more work.
The same problem appears with shell commands. A scanner can point to subprocess.run(), but a reviewer still needs to trace the command through assignments, string formatting, and branches. Then comes the harder question: can someone outside the intended trust boundary control that input?
This article has been indexed from DZone Security Zone
Read the original article: