This boils down to a core question:
If so, then the user already has access; there is nothing further to contemplate in the question as-stated; a "malicious" user will have just as much access as a "non-malicious" and you should go to a regular threat model for potentially-malicious logged-in users, such as sandboxing.
If not, then you really ought to:
- Set up a whitelist of permitted commands
- Ensure you are sanitizing (or, better-yet, parameterizing) user input appropriately
- example: if your toy CLI application is a Python program—
def handle_user_input(untrusted_string: str):
user_command = shlex.split(untrusted_string) #: list
if not user_command in whitelist:
raise ValueError("Non-whitelisted command.")
def event_callback(user_command: list):
"""Is called on the parameterized, whitelist-checked user_command list every interval"""
assert isinstance(user_command, list)
assert user_command in whitelist
- Consider contingencies for when one of the whitelisted programs has a shell-execution vulnerability anyway, and this use-case reduces to what where
sh is allowed (i.e.: sanbox the user.)
Your threat-model is poorly-defined in the question as-stated, but I hope this helps.
Also, check out this answer on another question — he expresses much better what I've tried to communicate here.
Allowing them to "run a command" is tantamount to letting them log in (after all, that's what "logging in" gates in the first place.)