OS Command Injection (ARCH5102)

Key go.security.os-command-injection · Severity error · Category security · CWE CWE-78

Concatenating untrusted input into a command string and running it through a shell (sh -c) lets an attacker execute arbitrary commands. Input must be passed as an argument, not to a shell.

Incorrect

cmd := exec.Command("sh", "-c", "ping -c 1 "+r.FormValue("host"))
out, _ := cmd.Output()

Correct

host := r.FormValue("host")
cmd := exec.Command("ping", "-c", "1", host) // no shell, separate arg
out, _ := cmd.Output()

Fix

Run the command without a shell and pass user input as a separate argument instead of a concatenated string.