1

Current code in my project is shown below and Veracode reports there is an OS command injection

filename = Regex.Replace(filename, "[^a-zA-Z0-9_]", "_") & ".svg"

ProcessStartInfo startInfo = default(ProcessStartInfo);
Process pStart = new Process();
startInfo = new ProcessStartInfo(myExecutedFilePath, "\"" + filename + "\" --export-pdf=\"" + filename + "\""); //OS command injection raises at this line
pStart.StartInfo = startInfo;
pStart.Start();
pStart.WaitForExit();

So, I research the solution to solve this issue from OWASP and Roslyn Security Guard.

And here is my code after modifying based on that posts.

filename = Regex.Replace(filename, "[^a-zA-Z0-9_]", "_") & ".svg"

ProcessStartInfo startInfo = default(ProcessStartInfo);
Process pStart = new Process();
startInfo = new ProcessStartInfo();
startInfo.FileName = myExecutedFilePath;
startInfo.Arguments = "\"" + filename + "\" --export-pdf=\"" + filename + "\""; //Veracode still reports the issue at this line
pStart.StartInfo = startInfo;
pStart.Start();
pStart.WaitForExit();

BUT, Veracode still reports OS command injection.

So my concerns here are:

  1. Did I apply the correct solution to solve OS command injection in this case?

  2. Or, Should I propose mitigation for it?

closed as off-topic by schroeder Jul 24 '18 at 8:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.