@pwntester please rebase so we only get one commit instead of a big merge. I think this would also be sensible to add to override predicate doubleDashIsSanitizing() in SystemCommandExecutors.qll, since I think "rsync ... -- " + userData would be as safe as letting someone control an rsync could ever be?

Please add a test case to https://github.com/github/codeql/tree/main/go/ql/test/query-tests/Security/CWE-078 too

@smowton let me know if it looks better now. Would it make sense to share these lists of commands with other languages in a shared qlpack or similar?

Wants a change-note, otherwise looks good

@pwntester The tests are failing because it doesn't like your declaration of a function namedhandler - there's already one in another file in the same folder. Also you need to rebase your branch onto main.

@pwntester Are you happy to merge this?

@owen-mc sure! I cant merge it though

@pwntester Ah, I didn't realise. I've done it now. Feel free to prod us if it looks like we've forgotten a PR, especially if it's ready to be merged.