Zennoxa Shield
Rules / Dart
SHIELD-DART-003

Command injection via interpolated process arguments

highDartCWE-78CVSS 8.6

What it detects

A Process call whose arguments contain interpolated variables can be manipulated to run arbitrary commands.

How to fix

Validate and whitelist arguments and never pass raw user input to a process invocation.

Vulnerable — Shield flags thisrepo_cloner.dart
import 'dart:io';

Future<void> cloneRepo(String org, String repo) async {
  // org/repo flow into the process arguments unvalidated
  await Process.run('git', ['clone', 'https://github.com/$org/$repo.git']);
}
Fixed — scans cleanrepo_cloner.dart
import 'dart:io';

final _name = RegExp(r'^[A-Za-z0-9_.-]+$');

Future<void> cloneRepo(String org, String repo) async {
  if (!_name.hasMatch(org) || !_name.hasMatch(repo)) {
    throw ArgumentError('invalid repository name');
  }
  final url = 'https://github.com/$org/$repo.git';
  await Process.run('git', ['clone', '--', url]);
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-DART-003, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-DART-003: Command injection via interpolated process arguments — Zennoxa Shield