OS command injection
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
def exec_command_noncompliant():
    from paramiko import client
    from flask import request
    address = request.args.get("address")
    cmd = "ping -c 1 %s" % address
    client = client.SSHClient()
    client.connect("ssh.samplehost.com")
    # Noncompliant: address argument is not sanitized.
    client.exec_command(cmd)
def exec_command_compliant():
    from paramiko import client
    from flask import request
    address = request.args.get("address")
    # Compliant: address argument is sanitized (shell-escaped).
    address = shlex.quote(request.args.get("address"))
    cmd = "ping -c 1 %s" % address
    client = client.SSHClient()
    client.connect("ssh.samplehost.com")
    client.exec_command(cmd)