Once triggered, dangerous-subprocess-use-tainted-env-args cannot be addressed

[pulkin]

Describe the bug

The subject rule can be triggered in some valid circumstances. But the suggested recipe is misleading or does not work at all.

1. The rule description mentioning using 'shlex.escape()' is wrong because shlex.escape is not a function (I suggest to replace it with shlex.quote()).
2. Using shlex.quote is not accepted by the rule. As a result, I ended up ignoring it. I am not sure if currently there is any reasonable way to address the rule once triggered.

To Reproduce

Try adding shlex.quote to the rule test cases and observe nothing changed in the static analysis report.

Expected behavior

The recipe to fix the triggering rule in the rule description works in practice.

Priority
How important is this to you?

• P0: blocking me from making progress
• P1: this will block me in the near future
• P2: annoying but not blocking me

[0xDC0DE]

Thanks for reporting this, @pulkin. I'm making the necessary updates like you suggested.

[pulkin]

Thanks for fixing this! Is this something that is immediately available when I run semgrep or it has to undergo some release process?