Insecure Use of Dangerous Function
This vulnerability category covers the following issues:
Why is this important?
C and C++, like any other programming language, has dangerous functions. If these functions are not used properly, it can have a catastrophic impact on your app. Attacker controlled input, that is processed by any of these functions, can lead to attackers getting full access to your production environment.
Check out this video for a high-level explanation:
Read below to find out how to fix this issue in your code.
Command Injection
The highlighted APIs below are used to execute system commands. If unfiltered input is passed to these APIs, it can lead to arbitrary command execution.
Option A: Use operating system APIs securely
Go through the issues that GuardRails identified in the PR.
Locate the dangerous function. For example:
- CreateProcess
- CreateProcessAsUser
- CreateProcessWithLogon
- ShellExecute
- WinExec
- execl
- execle
- execlp
- execv
- execvp
- popen
- system
Take one of the following actions:
- If the functionality is not required, then remove it.
- Ensure that no user input is processed by the function.
- If user input is processed, ensure that no special characters are allowed. E.g. validate that the user input only contains alphanumeric values.
- Ensure that the operating system environment is safe.
Test it and ensure the functionality works as expected
Ship it 🚢 and relax 🌴