rules:
  - id: ocamllint-exec
    patterns:
      - pattern-either:
        - pattern: Unix.execve $STR
        - pattern: Unix.execvp $STR
        - pattern: Unix.execvpe $STR
        - pattern: Unix.system $STR
        - pattern: Sys.command $STR
      - pattern-not: Unix.execve "..."
      - pattern-not: Unix.execvp "..."
      - pattern-not: Unix.execvpe "..."
      - pattern-not: Unix.system "..."
      - pattern-not: Sys.command "..."
    message: Executing external programs might lead to comand or argument injection vulnerabilities.
    languages: [ocaml]
    severity: WARNING
    metadata:
      category: security
      references:
      - https://v2.ocaml.org/api/Unix.html
      technology:
        - ocaml
      cwe: "CWE-78: OS Command Injection"
      confidence: LOW
      likelihood: MEDIUM
      impact: HIGH
      subcategory:
        - audit