Zennoxa Shield
Rules / Rust
SHIELD-RUST-005

Command execution via shell interpreter

criticalRustCWE-78CVSS 8.8

What it detects

Spawning a shell (sh -c / bash -c) with a constructed command enables command injection.

How to fix

Invoke the target binary directly with argument vectors instead of a shell.

Vulnerable — Shield flags thismain.rs
use std::process::Command;

fn nightly_backup() -> std::io::Result<()> {
    let status = Command::new("sh")
        .arg("-c")
        .arg("tar -czf /backups/site.tgz /var/www && sync")
        .status()?;
    println!("backup exited: {}", status);
    Ok(())
}
Fixed — scans cleanmain.rs
use std::process::Command;

fn nightly_backup() -> std::io::Result<()> {
    let status = Command::new("tar")
        .arg("-czf")
        .arg("/backups/site.tgz")
        .arg("/var/www")
        .status()?;
    println!("backup exited: {}", status);
    Ok(())
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUST-005, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUST-005: Command execution via shell interpreter — Zennoxa Shield