How to securely use Process.Start?

Question

I am using Process.Start in a Windows Service I created to execute an exe that I have on my server that is used for audio conversion. I am passing some user input as a parameter to this exe. The code looks something like this:

string filePath = "\ffmpeg.exe";
string parameters =  String.Format(@"-i ""{0}"" -f mp3 ""{1}""", 
                           LocalFileName,
                           tempDirectory + NewFileName);
ProcessStartInfo startInfo = new ProcessStartInfo(ffmpegPath, parameters);
Process proc = Process.Start(startInfo);

The variables LocalFileName and NewFileName are set from user input. If I want to protect against OS Injection, is it sufficient to strip out any & characters or is there more that I should be doing?

Answer 1

Extra arguments into the parameters Strip any quotes from your string to ensure they can't throw in there own arguments into the command-line.

Eat your disk space Strip out ./\ characters. As if you don't you'll get an attack like "\Windows\Filename" would actually write file to ":\Windows\TempDirName\Filename" and when you later need to clean your temp files the attackers file will be in different location than you'll be looking to clean.

E.g. You'll be looking at "C:\AudioConversion\Temp\" When attackers file will be at: "C:\Windows\Temp\"

Does ffmpeg.exe have any vulnerabilities in version your using? Have a look at penetration websites for any vulnerabilities against this tool. If you're familiar with this process ofcourse give it ago yourself for extra safety. You could enable DEP for this process if you're paranoid.

Buffer overflows in your program? Yes, highly unlikely unless you're using unsafe modifier or making native calls etc but do review it.

Answer 2

You're starting the process with parameters, not submitting a command line. Using Process.Start is like running parameterized SQL.