Skip to content

Check command call and ensure there is no unsanitized data used. The variable name may need to be validated #8

@brettcurtis

Description

@brettcurtis

In Go, the exec.Command function is used to run external commands. Using this function carelessly can lead to command injection vulnerabilities. Carefully review the data flow that leads to a command execution and ensures no data can be injected by a third-party.
Command injection occurs when untrusted input is passed directly to a system shell, allowing an attacker to execute arbitrary commands. This can result in unauthorized access to the system, data leaks, or other security breaches.
Avoid executing commands constructed using user-provided data, or if you must, always validate and sanitize user inputs before passing them to exec.Command.
How to remediate?
Either remove the user-controlled data, filter the potential command with a list of allowed command or sanitize the command before execution.
If there still are variables in the arguments to exec.Command after remediation, include the following comment before the line to suppress the warning: // no-dd-sa:go-security/command-injection

Metadata

Metadata

Assignees

No one assigned

    Labels

    securitySecurity vulnerability or configuration

    Type

    Projects

    Status

    Todo ✏

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions