import os import shlex # Taint must CLEAR when a name is rebound to a non-source value (#29). # Neither function below may produce a finding. def reassigned_constant(): g = os.getenv("G") # tainted source g = "safe-constant" # rebound to a literal -> taint must clear os.system(g) # must NOT be flagged def sanitized_reassignment(): x = input("path> ") # tainted source x = shlex.quote(x) # rebound to a non-source call -> taint must clear os.system(x) # must NOT be flagged