feat(three-stage-scan): add aliased-sink mutation the regex scan misses

benchmarks/fixtures/mutation-python/app.py

@@ -0,0 +1,13 @@
+"""Mutation of os.system: the callable is aliased before use so a same-line regex misses it."""
+import os
+
+from flask import Flask, request
+
+app = Flask(__name__)
+run_cmd = os.system
+
+
+@app.get("/ping")
+def ping():
+    host = request.args["host"]
+    return run_cmd("ping -c 1 " + host)  # CWE-78 mutation: os.system aliased before the call

benchmarks/manifests/mutation-python.toml

@@ -0,0 +1,20 @@
+name = "mutation-python"
+language = "python_web"
+frameworks = ["flask"]
+setup = ["pip install flask"]
+modes = ["quick", "standard"]
+known_noise = []
+baselines = []
+
+[source]
+type = "local"
+path = "../fixtures/mutation-python"
+
+[[expected]]
+cwe = "CWE-78"
+class = "command injection"
+path = "app.py"
+line = 13
+function = "ping"
+sink = "run_cmd"
+evidence = "aliased os.system runs an attacker-controlled command"