thuban 0.4.3 → 0.4.5

package/dist/packages/crucible/rules/command-injection.json

@@ -1,411 +1,411 @@
-[
-  {
-    "id": "CMD001",
-    "pattern": "exec(?:Sync|FileSync)?\\s*\\([^)]*\\+|os\\.system\\s*\\(|exec\\.Command\\s*\\([^)]*\\+",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection (original)",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD002",
-    "pattern": "spawn\\s*\\([^)]*shell\\s*:\\s*true",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — JS/TS: spawn with shell:true, execa",
-    "language": [
-      "js",
-      "ts"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD003",
-    "pattern": "execa(?:\\.command)?\\s*\\(",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — JS/TS: spawn with shell:true, execa",
-    "language": [
-      "js",
-      "ts"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD004",
-    "pattern": "subprocess\\s*\\.\\s*(?:call|check_output|Popen|run)\\s*\\([^)]*shell\\s*=\\s*True",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
-    "language": [
-      "python"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD005",
-    "pattern": "os\\s*\\.\\s*popen\\s*\\(",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
-    "language": [
-      "python"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD006",
-    "pattern": "\\.exec_command\\s*\\(",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
-    "language": [
-      "python"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD007",
-    "pattern": "`[^`]*#\\{[^}]+\\}[^`]*`",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD008",
-    "pattern": "\\b(?:system|exec)\\s*\\(\\s*[\"'`]?[^\"'`\\n]*#\\{|\\b(?:system|exec)\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\+",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD009",
-    "pattern": "\\bIO\\.popen\\s*\\(|Open3\\.\\w+\\s*\\(",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD010",
-    "pattern": "Runtime\\s*\\.\\s*getRuntime\\s*\\(\\s*\\)\\s*\\.\\s*exec\\s*\\(",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — Java/Kotlin: Runtime.exec, ProcessBuilder",
-    "language": [
-      "kotlin",
-      "java"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD011",
-    "pattern": "new\\s+ProcessBuilder\\s*\\(",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — Java/Kotlin: Runtime.exec, ProcessBuilder",
-    "language": [
-      "kotlin",
-      "java"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD012",
-    "pattern": "Process\\s*\\.\\s*Start\\s*\\(|new\\s+ProcessStartInfo\\s*[({]",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — C#: Process.Start / ProcessStartInfo",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD013",
-    "pattern": "Command\\s*::\\s*new\\s*\\(",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — Rust: Command::new",
-    "language": [
-      "rust"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD014",
-    "pattern": "\\bshell_exec\\s*\\(|\\bpassthru\\s*\\(|\\bpopen\\s*\\(",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD015",
-    "pattern": "\\bsystem\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\.\\s*\\$|\\bsystem\\s*\\(\\s*\\$",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD016",
-    "pattern": "`[^`]*\\$(?:_GET|_POST|_REQUEST|_COOKIE|\\w+)[^`]*`",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD017",
-    "pattern": "exec\\s*\\.\\s*Command\\s*\\([^)]*fmt\\.Sprintf|exec\\s*\\.\\s*Command\\s*\\([^)]*parts\\b",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — Go: exec.Command with fmt.Sprintf, user-split args, or /bin/sh -c pattern",
-    "language": [
-      "go"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD018",
-    "pattern": "exec\\s*\\.\\s*Command\\s*\\(\\s*[\"']\\/bin\\/(?:sh|bash)[\"']\\s*,\\s*[\"']-c[\"']",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — Go: exec.Command with fmt.Sprintf, user-split args, or /bin/sh -c pattern",
-    "language": [
-      "go"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD019",
-    "pattern": "\\bexec\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\.\\s*\\$|\\bexec\\s*\\(\\s*\\$",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Command injection — PHP: exec() with user input",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD020",
-    "pattern": "ProcessStartInfo\\s*\\{[^}]*Arguments\\s*=\\s*\\$[\"']",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD021",
-    "pattern": "Arguments\\s*=\\s*\\$[\"'][^\"']*\\{(?:host|cmd|args|input|filename|email|script)",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD022",
-    "pattern": "new ProcessStartInfo\\s*\\(\\s*[\"'][^\"']*(?:bash|sh|cmd)[\"']",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD023",
-    "pattern": "`[^`]*#\\{[^`]*`",
-    "flags": "",
-    "category": "command_injection",
-    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD024",
-    "pattern": "\\bsystem\\s*\\([^)]*#\\{",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD025",
-    "pattern": "\\bexec\\s*\\([^)]*#\\{",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD026",
-    "pattern": "Open3\\.capture2\\s*\\(.*(?:#\\{|cmd)",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD027",
-    "pattern": "IO\\.popen\\s*\\([^)]*#\\{",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD028",
-    "pattern": "\\bspawn\\s*\\([^)]*#\\{",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
-    "language": [
-      "ruby"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD029",
-    "pattern": "\\bexec\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$(?:_GET|_POST|host|cmd|ip)",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "PHP command injection",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD030",
-    "pattern": "shell_exec\\s*\\([^)]*\\$(?:_GET|_POST|domain|ip|host|cmd|server)",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "PHP command injection",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD031",
-    "pattern": "\\bsystem\\s*\\([^)]*\\$(?:_GET|_POST|src|dest|format|file)",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "PHP command injection",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD032",
-    "pattern": "passthru\\s*\\([^)]*\\$(?:_POST|_GET|archive|zip|dest)",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "PHP command injection",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD033",
-    "pattern": "popen\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$(?:_GET|pattern|logfile)",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "PHP command injection",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD034",
-    "pattern": "exec\\.Command\\s*\\(\\s*[\"'][^\"']*(?:bash|sh)[\"'][^)]*\"-c\"",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "Go command injection",
-    "language": [
-      "go"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD035",
-    "pattern": "exec\\.Command\\s*\\(\\s*[\"'][^\"']*(?:sh|bash)[\"'][^)]*cmdStr",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "Go command injection",
-    "language": [
-      "go"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "CMD036",
-    "pattern": "cmd\\s*:=\\s*exec\\.Command\\s*\\([^)]*\\+",
-    "flags": "i",
-    "category": "command_injection",
-    "description": "Go command injection",
-    "language": [
-      "go"
-    ],
-    "severity": "critical"
-  }
-]
+[
+  {
+    "id": "CMD001",
+    "pattern": "exec(?:Sync|FileSync)?\\s*\\([^)]*\\+|os\\.system\\s*\\(|exec\\.Command\\s*\\([^)]*\\+",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection (original)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD002",
+    "pattern": "spawn\\s*\\([^)]*shell\\s*:\\s*true",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — JS/TS: spawn with shell:true, execa",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD003",
+    "pattern": "execa(?:\\.command)?\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — JS/TS: spawn with shell:true, execa",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD004",
+    "pattern": "subprocess\\s*\\.\\s*(?:call|check_output|Popen|run)\\s*\\([^)]*shell\\s*=\\s*True",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
+    "language": [
+      "python"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD005",
+    "pattern": "os\\s*\\.\\s*popen\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
+    "language": [
+      "python"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD006",
+    "pattern": "\\.exec_command\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Python: subprocess variants with shell=True, os.popen, paramiko",
+    "language": [
+      "python"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD007",
+    "pattern": "`[^`]*#\\{[^}]+\\}[^`]*`",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD008",
+    "pattern": "\\b(?:system|exec)\\s*\\(\\s*[\"'`]?[^\"'`\\n]*#\\{|\\b(?:system|exec)\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\+",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD009",
+    "pattern": "\\bIO\\.popen\\s*\\(|Open3\\.\\w+\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Ruby: backtick with interpolation, system, exec, Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD010",
+    "pattern": "Runtime\\s*\\.\\s*getRuntime\\s*\\(\\s*\\)\\s*\\.\\s*exec\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Java/Kotlin: Runtime.exec, ProcessBuilder",
+    "language": [
+      "kotlin",
+      "java"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD011",
+    "pattern": "new\\s+ProcessBuilder\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Java/Kotlin: Runtime.exec, ProcessBuilder",
+    "language": [
+      "kotlin",
+      "java"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD012",
+    "pattern": "Process\\s*\\.\\s*Start\\s*\\(|new\\s+ProcessStartInfo\\s*[({]",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — C#: Process.Start / ProcessStartInfo",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD013",
+    "pattern": "Command\\s*::\\s*new\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Rust: Command::new",
+    "language": [
+      "rust"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD014",
+    "pattern": "\\bshell_exec\\s*\\(|\\bpassthru\\s*\\(|\\bpopen\\s*\\(",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD015",
+    "pattern": "\\bsystem\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\.\\s*\\$|\\bsystem\\s*\\(\\s*\\$",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD016",
+    "pattern": "`[^`]*\\$(?:_GET|_POST|_REQUEST|_COOKIE|\\w+)[^`]*`",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — PHP: shell_exec, system, passthru, popen, backtick with variable",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD017",
+    "pattern": "exec\\s*\\.\\s*Command\\s*\\([^)]*fmt\\.Sprintf|exec\\s*\\.\\s*Command\\s*\\([^)]*parts\\b",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Go: exec.Command with fmt.Sprintf, user-split args, or /bin/sh -c pattern",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD018",
+    "pattern": "exec\\s*\\.\\s*Command\\s*\\(\\s*[\"']\\/bin\\/(?:sh|bash)[\"']\\s*,\\s*[\"']-c[\"']",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — Go: exec.Command with fmt.Sprintf, user-split args, or /bin/sh -c pattern",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD019",
+    "pattern": "\\bexec\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\.\\s*\\$|\\bexec\\s*\\(\\s*\\$",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Command injection — PHP: exec() with user input",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD020",
+    "pattern": "ProcessStartInfo\\s*\\{[^}]*Arguments\\s*=\\s*\\$[\"']",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD021",
+    "pattern": "Arguments\\s*=\\s*\\$[\"'][^\"']*\\{(?:host|cmd|args|input|filename|email|script)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD022",
+    "pattern": "new ProcessStartInfo\\s*\\(\\s*[\"'][^\"']*(?:bash|sh|cmd)[\"']",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "C# command injection: ProcessStartInfo / Process.Start with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD023",
+    "pattern": "`[^`]*#\\{[^`]*`",
+    "flags": "",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD024",
+    "pattern": "\\bsystem\\s*\\([^)]*#\\{",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD025",
+    "pattern": "\\bexec\\s*\\([^)]*#\\{",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD026",
+    "pattern": "Open3\\.capture2\\s*\\(.*(?:#\\{|cmd)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD027",
+    "pattern": "IO\\.popen\\s*\\([^)]*#\\{",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD028",
+    "pattern": "\\bspawn\\s*\\([^)]*#\\{",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Ruby command injection: backtick, system(), exec(), Open3, IO.popen",
+    "language": [
+      "ruby"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD029",
+    "pattern": "\\bexec\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$(?:_GET|_POST|host|cmd|ip)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD030",
+    "pattern": "shell_exec\\s*\\([^)]*\\$(?:_GET|_POST|domain|ip|host|cmd|server)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD031",
+    "pattern": "\\bsystem\\s*\\([^)]*\\$(?:_GET|_POST|src|dest|format|file)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD032",
+    "pattern": "passthru\\s*\\([^)]*\\$(?:_POST|_GET|archive|zip|dest)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD033",
+    "pattern": "popen\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$(?:_GET|pattern|logfile)",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "PHP command injection",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD034",
+    "pattern": "exec\\.Command\\s*\\(\\s*[\"'][^\"']*(?:bash|sh)[\"'][^)]*\"-c\"",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Go command injection",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD035",
+    "pattern": "exec\\.Command\\s*\\(\\s*[\"'][^\"']*(?:sh|bash)[\"'][^)]*cmdStr",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Go command injection",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "CMD036",
+    "pattern": "cmd\\s*:=\\s*exec\\.Command\\s*\\([^)]*\\+",
+    "flags": "i",
+    "category": "command_injection",
+    "description": "Go command injection",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  }
+]