Prevent shell injection

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: csharp-security/shell-injection

Language: C#

Severity: Warning

Category: Security

CWE: 78

Description

Never build a command to execute manually by concatenating strings. Instead, validate each component of the command to ensure there is no user-input.

Learn More

Non-Compliant Code Examples

public class Sample
{
    public void myMethod(string myProgram)
    {
        Process p = new Process();
        p.StartInfo.FileName = "path/to/" + myProgram;
        p.Start();
    }
}

public class Runner {
    public static int Run(string cmd, string args, string input) {
        ProcessStartInfo startInfo = new ProcessStartInfo
        {
            WorkingDirectory = Settings.RootDir,
            FileName = cmd,
            Arguments = args,
            UseShellExecute = false,
            RedirectStandardInput = true,
            RedirectStandardError = true,
            RedirectStandardOutput = true,
        };
        using (Process process = new Process())
        {
            process.EnableRaisingEvents = true;
            process.StartInfo = startInfo;
            process.Start();
        }
    }
}
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Analysis