ID: csharp-security/shell-injection
Language: C#
Severity: Warning
Category: Security
CWE: 78
Description
Never build a command to execute manually by concatenating strings. Instead, validate each component of the command to ensure there is no user-input.
Learn More
Non-Compliant Code Examples
public class Sample
{
public void myMethod(string myProgram)
{
Process p = new Process();
p.StartInfo.FileName = "path/to/" + myProgram;
p.Start();
}
}
public class Runner {
public static int Run(string cmd, string args, string input) {
ProcessStartInfo startInfo = new ProcessStartInfo
{
WorkingDirectory = Settings.RootDir,
FileName = cmd,
Arguments = args,
UseShellExecute = false,
RedirectStandardInput = true,
RedirectStandardError = true,
RedirectStandardOutput = true,
};
using (Process process = new Process())
{
process.EnableRaisingEvents = true;
process.StartInfo = startInfo;
process.Start();
}
}
}
Seamless integrations. Try Datadog Code Analysis
