Metadata

ID: csharp-security/shell-injection

Language: C#

Severity: Warning

Category: Security

Description

Never build a command to execute manually by concatenating strings. Instead, validate each component of the command to ensure there is no user-input.

Learn More

• CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)

Non-Compliant Code Examples

public class Sample
{
    public void myMethod(string myProgram)
    {
        Process p = new Process();
        p.StartInfo.FileName = "path/to/" + myProgram;
        p.Start();
    }
}

Seamless integrations. Try Datadog Code Analysis

Datadog Code Analysis