Zennoxa Shield
Rules / C#
SHIELD-CSHARP-004

Command injection via Process.Start with concatenation

criticalC#CWE-78CVSS 9.1

What it detects

Process.Start is invoked with a command or argument string built from concatenated untrusted input.

How to fix

Pass a fixed executable path and supply arguments as a validated ProcessStartInfo.ArgumentList collection.

Vulnerable — Shield flags thisPingController.cs
using System.Diagnostics;

public class PingController
{
    public void Ping(string host)
    {
        Process.Start("/bin/sh", "-c \"ping -c 1 " + host + "\"");
    }
}
Fixed — scans cleanPingController.cs
using System.Diagnostics;

public class PingController
{
    public void Ping(string host)
    {
        var psi = new ProcessStartInfo("/usr/bin/ping");
        psi.ArgumentList.Add("-c");
        psi.ArgumentList.Add("1");
        psi.ArgumentList.Add(host);
        Process.Start(psi);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-004, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-004: Command injection via Process.Start with concatenation — Zennoxa Shield