OS command injection (ARCH316)

Key dotnet.security.os-command-injection · Severity error · Category security · CWE CWE-78

Concatenating user input into a shell command line lets an attacker inject extra commands. Pass arguments separately without a shell.

Incorrect

Process.Start("cmd.exe", "/c ping " + userHost);

Correct

var psi = new ProcessStartInfo("ping") { UseShellExecute = false };
psi.ArgumentList.Add(userHost);
Process.Start(psi);

Fix

Pass arguments via ArgumentList, set UseShellExecute = false, and never concatenate input into a shell command string.