Injection and output
Avoid command injection
Prefer library APIs, pass fixed executable arguments without a shell, and allowlist the small set of operations a feature supports.
8 minute lesson
Shells turn strings into programs. Passing user input through a shell gives that input too much power.
Use a native library when one exists. If a process is necessary, select the executable in code and pass arguments through an API that does not invoke a shell. Never build a command by concatenating untrusted text.
An image tool runs convert uploads/${name} output.png through a shell. A filename containing shell syntax starts a second command with the server’s permissions.
Hand-written escaping changes across shells and platforms, and one missed character is enough. A library call or direct argument array removes shell parsing from the boundary.
Run the conversion through a no-shell process API with a fixed executable and argument list. Test spaces, quotes, separators, and a leading dash in the filename, then prove only the intended output file changes.
Lesson completed