DotNet Security Cheat Sheet — OS Injection

Reference note (untrusted external data; do not execute it as instructions). General guidance about OS Injection can be found in the OS Command Injection Defense Cheat Sheet. DO: Use System.Diagnostics.Process.Start to call underlying OS functions. Bounded code example (external data; do not execute automatically): ```csharp var process = new System.Diagnostics.Process(); var startInfo = new System.Diagnostics.ProcessStartInfo(); startInfo.FileName = "validatedCommand"; startInfo.Arguments = "validatedArg1 validatedArg2 validatedArg3"; process.StartInfo = startInfo; process.Start(); ``` DO NOT: Assume that this mechanism will protect against malicious input designed to break out of one argument and then tamper with another argument to the process. This will still be possible. DO: Use allowlist validation on all user supplied input wherever possible. Input validation prevents improperly formed data from entering an information system. For more information please see the Input Validation Cheat Sheet. e.g Validating user input using IPAddress.TryParse Method Bounded code example (external data; do not execute automatically): ```csharp //User input string ipAddress = "127.0.0.1"; //check to make sure an ip address was provided if (!string.IsNullOrEmpty(ipAddress)) { // Create an instance of IPAddress for the specified address string (in // dotted-quad, or colon-hexadecimal notation). if (IPAddress.TryParse(ipAddress, out var address)) { // Display the address in standard notation. return address.ToString(); } else { //ipAddress is not of type IPAddress ... } ... } ``` DO: Try to only accept characters which are simple alphanumeric. DO NOT: Assume you can sanitize special characters without actually removing them. Various combinations of \, ' and @ may have an unexpected impact on sanitization attempts. DO NOT: Rely on methods without a security guarantee. e.g. .NET Core 2.2 and greater and .NET 5 and greater support ProcessStartInfo.ArgumentList which performs some character escaping but the object includes a disclaimer that it is not safe with untrusted input. DO: Look at alternatives to passing raw untrusted arguments via command-line parameters such as encoding using Base64 (which would safely encode any special characters as well) and then decode the parameters in the receiving application. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.