assume shell=False for subprocess calls, fixes FPs in e.g. youtube-dl

Author: erik-krogh

python/ql/lib/semmle/python/frameworks/Stdlib.qll

@@ -1209,7 +1209,7 @@ private module StdlibPrivate {
         this.get_shell_arg().getAValueReachingSink().asExpr().(ImmutableLiteral).booleanValue()
       or
       not this.get_shell_arg().getAValueReachingSink().asExpr() instanceof ImmutableLiteral and
-      result = [true, false]
+      result = false // defaults to `False`
     }
 
     /** Gets the API-node for the `executable` argument, if any. */

python/ql/test/query-tests/Security/CWE-078-UnsafeShellCommandConstruction/src/unsafe_shell_test.py

@@ -41,4 +41,6 @@ def subprocess_flag (name):
     def indirect(flag, x): 
         subprocess.run("ping " + x, shell=flag) # $result=BAD
 
-    indirect(True, name)
+    indirect(True, name)
+
+    subprocess.Popen("ping " + name, shell=unknownValue) # OK - shell assumed to be False