SH019: Unsafe code execution or deserialization in Python

Severity: high · Category: security · Applies to: django, fastapi, flask

Why it matters

eval, exec, shell commands built from strings and unpickling run attacker-controlled input as code whenever any part of it comes from a user or from an untrusted file.

How to fix

Avoid eval and exec. Pass subprocess an argument list without shell=True, use json instead of pickle, and yaml.safe_load instead of yaml.load.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH019

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH019