import os
import subprocess

# Locks the subprocess/os.system command sinks and the file-write sink (#28).


def run_user_command():
    cmd = input("cmd> ")             # tainted source
    subprocess.run(cmd, shell=True)  # sink: subprocess.* -> AST-CMD-EXEC


def shell_from_env():
    target = os.getenv("TARGET")     # tainted source
    os.system(target)                # sink: os.system -> AST-CMD-EXEC


def leak_to_file():
    payload = os.environ["DATA"]     # tainted source
    log = open("out.txt", "w")       # write handle
    log.write(payload)               # sink: file.write -> AST-FILE-WRITE (high)