Zennoxa Shield
Rules / Dart
SHIELD-DART-002

Command injection via shell process execution

criticalDartCWE-78CVSS 9.8

What it detects

Process.run or Process.start invoked through a shell can execute injected commands.

How to fix

Pass a fixed executable with an argument list and avoid runInShell with untrusted input.

Vulnerable — Shield flags thisdiagnostics_runner.dart
import 'dart:io';

Future<String> runDiagnostics(String userCommand) async {
  // Command injection: userCommand is handed to a shell
  final result = await Process.run("sh", ["-c", userCommand]);
  return result.stdout as String;
}
Fixed — scans cleandiagnostics_runner.dart
import 'dart:io';

Future<String> runDiagnostics(String target) async {
  const allowed = {'disk', 'memory', 'network'};
  if (!allowed.contains(target)) throw ArgumentError('unknown check');
  final result = await Process.run('/usr/bin/diag-tool', ['--check', target]);
  return result.stdout as String;
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-DART-002, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-DART-002: Command injection via shell process execution — Zennoxa Shield