### Shell Parsing Behavior Impact on Parameter Injection Points

- In some modern languages' subprocess APIs, shell character parsing is not enabled by default, which means that even if a parameter has malicious concatenation, injection cannot be achieved. For example: `os.Exec` in Go, `subprocess.run` in Python, etc. -- unless shell is manually enabled, such as executing concatenated parameters via `bash -c` or specifying `shell=True`.
- Some functions perform shell parsing by default, such as `os.system`.

Therefore, you must carefully distinguish these safe cases during analysis.

### Partial Safe Validation Methods

The following are several validation methods assessed as safe. Unlisted methods must have their safety evaluated independently.

- Strict character whitelist: does not allow any shell special characters
  - Bypass: Generally considered not bypassable
- Strict content whitelist: only allows input of specifically enumerated content
  - Bypass: Generally considered not bypassable
