How to fix OS Command Injection

What an attacker can do

The concrete impact of leaving OS Command Injection unpatched.

How to fix OS Command Injection

5 ordered steps. Apply them in order — each builds on the previous.

1. 1

   Pass arguments as an array — no shell

   Every language has a way to invoke an external program with explicit args, no shell interpretation. Use it.

   Node: `child_process.execFile()` or `spawn()` with array args. Python: `subprocess.run([...], shell=False)`. PHP: pcntl_exec() or escapeshellarg(). Ruby: `Kernel.exec(prog, *args)` (multi-arg form). Go: `exec.Command(name, args...)`.

   javascriptStep 1

   import { execFile, spawn } from "node:child_process";
   
   // ❌ exec — runs through shell, vulnerable
   exec(`convert ${userFilename} out.jpg`);
   
   // ✅ execFile — no shell, args are literal
   execFile("convert", [userFilename, "out.jpg"]);
   
   // Or spawn for streaming
   const proc = spawn("convert", [userFilename, "out.jpg"]);
   
   // Python equivalent:
   // import subprocess
   // subprocess.run(["convert", user_filename, "out.jpg"], check=True)
   // (default shell=False — safe)
   
   // PHP — use proc_open with arg array
   // $proc = proc_open(["convert", $userFilename, "out.jpg"], $descriptorspec, $pipes);
   // Or escapeshellarg() each argument when shell is unavoidable
   // system("convert " . escapeshellarg($userFilename) . " out.jpg");

2. 2

   Allow-list when the command itself comes from input

   Sometimes the command name is user-controlled (e.g., choosing which converter to run). Allow-list the names; never construct from input.

   Map user input to a fixed set of allowed commands. The user picks from a menu; you look up the command server-side.

   pythonStep 2

   import subprocess
   
   ALLOWED_CONVERTERS = {
       "to-pdf": ["libreoffice", "--headless", "--convert-to", "pdf"],
       "to-png": ["convert", "-resize", "1024x"],
       "to-mp4": ["ffmpeg", "-i", "-", "-c:v", "libx264"],
   }
   
   def convert(format_id: str, input_path: str, output_path: str):
       if format_id not in ALLOWED_CONVERTERS:
           raise ValueError("Unsupported format")
       cmd = ALLOWED_CONVERTERS[format_id] + [input_path, output_path]
       subprocess.run(cmd, check=True, timeout=60, shell=False)

3. 3

   Validate input format before passing to subprocess

   Even with shell=False, some programs interpret their own arguments unsafely (find -exec, ssh -o, gpg --batch). Whitelist input format.

   If the input is a filename, restrict to `[A-Za-z0-9._-]+`. If a domain, RFC 1035 hostname regex. If a number, `int()` cast. Reject anything else.

   goStep 3

   package main
   
   import (
       "errors"
       "os/exec"
       "regexp"
   )
   
   var validHostname = regexp.MustCompile(`^[a-zA-Z0-9.-]+$`)
   
   func ping(host string) ([]byte, error) {
       if !validHostname.MatchString(host) {
           return nil, errors.New("invalid hostname")
       }
       if len(host) > 253 {
           return nil, errors.New("hostname too long")
       }
       // ✅ exec.Command — no shell
       cmd := exec.Command("ping", "-c", "4", "-W", "5", host)
       return cmd.Output()
   }

4. 4

   Use language-native libraries instead of subprocess where possible

   Most things you'd shell out for have a library equivalent. Use the library — no shell, no injection surface.

   Image processing: sharp / Pillow / ImageMagick bindings. Zip/tar: archive libraries. Network: built-in DNS / HTTP libs. Git: gitpython / nodegit / go-git.

   pythonStep 4

   # ❌ Shelling out to imagemagick
   subprocess.run(["convert", input_path, "-resize", "300x300", output_path])
   
   # ✅ Use Pillow (Python) or sharp (Node)
   from PIL import Image
   img = Image.open(input_path)
   img.thumbnail((300, 300))
   img.save(output_path)
   
   # ❌ Shelling out to git
   subprocess.run(["git", "clone", repo_url])
   
   # ✅ Use GitPython
   from git import Repo
   Repo.clone_from(repo_url, "/tmp/clone")  # repo_url still validated

5. 5

   Sandbox subprocess with seccomp / AppArmor + drop privileges

   Defense-in-depth: even successful command injection achieves limited harm if the process can only access /tmp and can't network out.

   Run worker subprocesses as non-root, in a container with read-only root filesystem, network=none, and seccomp filter blocking dangerous syscalls.

   yamlStep 5

   # Docker for image-processing worker
   services:
     image-worker:
       image: my-worker
       read_only: true
       tmpfs:
         - /tmp:size=100M
       network_mode: none
       cap_drop: [ALL]
       user: "65534:65534"
       security_opt:
         - no-new-privileges:true
         - seccomp=image-worker-seccomp.json
       mem_limit: 512m
       cpus: 1.0
       pids_limit: 100