Prevent shell injection

Docs > Code Analysis > Static Analysis Rules > Prevent shell injection

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

ID: csharp-security/shell-injection

Language: C#

Severity: Warning

Category: Security

CWE: 78

Description

Never build a command to execute manually by concatenating strings. Instead, validate each component of the command to ensure there is no user-input.

Learn More

CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)

Non-Compliant Code Examples

public class Sample
{
    public void myMethod(string myProgram)
    {
        Process p = new Process();
        p.StartInfo.FileName = "path/to/" + myProgram;
        p.Start();
    }
}

public class Runner {
    public static int Run(string cmd, string args, string input) {
        ProcessStartInfo startInfo = new ProcessStartInfo
        {
            WorkingDirectory = Settings.RootDir,
            FileName = cmd,
            Arguments = args,
            UseShellExecute = false,
            RedirectStandardInput = true,
            RedirectStandardError = true,
            RedirectStandardOutput = true,
        };
        using (Process process = new Process())
        {
            process.EnableRaisingEvents = true;
            process.StartInfo = startInfo;
            process.Start();
        }
    }
}