@main[] $s[ ^taint[html][ some html code ] ^taint[parser-code][ ^$b(2+2) ] ^taint[regex][ ^^(.*?)^$ ] ^taint[ some code ] ] ^apply-taint[$s] ^apply-taint[html;$s] ^apply-taint[regex;$s] $f[^file::exec[cat^os[-windows].sh; $.stdin[$s] ;stdin]] $f.text code coverage tests: 2. ^try-catch{ ^file::exec[cat^os[-windows].sh; $.HTTP_OK[value] $.CGI_OK[value] $.REMOTE_ADDR[allowed] $.unsafe_env_name[env_value] ] } 3. ^try-catch{ ^file::exec[text] } 4. ^try-catch{ ^file::exec[cat^os[-windows].sh; $.stdin[ $.hash[] ] ] } 5. ^try-catch{ ^file::exec[cat^os[-windows].sh; ;arg1;^table::create[nameless]{arg2}; $.arg_hash[] ] } 6. $f[^file::exec[cat^os[-windows].sh; ;args;^table::create[nameless]{arg 2};;^table::create[nameless]{arg 4^#0Aarg 5};arg 6]] $f.text 7. $f[^file::exec[cat^os[-windows].sh; ;^array::create[args;arg 2;;arg4]](5)[arg6]] $f.text 8. $f[^file::exec[cat^os[-windows].sh; ;args;]] $f.text 9. $f[^file::exec[cat^os[-windows].sh; ;args;arg 2;;]] $f.text 10. ^try-catch{ $f[^file::exec[cat^os[-windows].sh; ;^array::create[args; $.bug[yes] ]]] }