CommandInjection.qhelp

<!DOCTYPE qhelp PUBLIC
  "-//Semmle//qhelp//EN"
  "qhelp.dtd">
<qhelp>
<overview>
<p>Code that passes user input directly to
<code>exec</code>, <code>eval</code>, or some other library
routine that executes a command, allows the user to execute malicious
code.</p>

</overview>
<recommendation>

<p>If possible, use hard-coded string literals to specify the command to run
or the library to load. Instead of passing the user input directly to the
process or library function, examine the user input and then choose
among hard-coded string literals.</p>

<p>If the applicable libraries or commands cannot be determined at
compile time, then add code to verify that the user input string is
safe before using it.</p>

</recommendation>
<example>

<p>The following example shows two functions. The first is unsafe as it takes a shell script that can be changed
by a user, and passes it straight to <code>subprocess.call()</code> without examining it first. 
The second is safe as it selects the command from a predefined allowlist.</p>

<sample src="examples/command_injection.py" />

</example>
<references>

<li>
OWASP:
<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
</li>

</references>
</qhelp>