Rules / C#
SHIELD-CSHARP-005
Command injection via ProcessStartInfo.Arguments from variable
What it detects
ProcessStartInfo.Arguments is assigned a value derived from concatenation or a raw variable.
How to fix
Use ArgumentList with individually validated arguments instead of building a single Arguments string.
Vulnerable — Shield flags thisBackupService.cs
using System.Diagnostics;
public class BackupService
{
public void Sync(string targetDir)
{
var psi = new ProcessStartInfo("/usr/bin/rsync");
psi.Arguments = $"-a --delete {targetDir}";
Process.Start(psi);
}
}
Fixed — scans cleanBackupService.cs
using System.Diagnostics;
public class BackupService
{
public void Sync(string targetDir)
{
var psi = new ProcessStartInfo("/usr/bin/rsync");
psi.ArgumentList.Add("-a");
psi.ArgumentList.Add("--delete");
psi.ArgumentList.Add(targetDir);
Process.Start(psi);
}
}
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-005, the fixed one does not.