Shell injection

Rule ID: security.shell-command-injection@1.0.0. Availability below refers to source-scan at product 524fa07e.

V-SEC-04 — Shell injection#

Shell injection. It examines trust boundaries, sensitive flows, validation, and security-sensitive effects.

Availability#

Not available in source-scan. There is no source-scan flag to activate this condition.

Example and action#

Illustrative pattern only. This is not a complete runnable package or a reproduced source-scan result. Helper APIs and omitted context must be supplied by the application.

swift

import Foundation
let process = Process()
process.executableURL = URL(fileURLWithPath: "/bin/sh")
process.arguments = ["-c", "convert \(input)"]

Replace the shell executable as well as its arguments. Here trustedConverterPath is an application-controlled absolute path to a trusted converter whose documented interface accepts -- followed by a file operand. Never derive the executable path from input. Validate the permitted files and the converter-specific argument semantics: separating arguments prevents shell interpretation but does not make every tool invocation safe. Prefer a library API when possible.

swift

import Foundation
let process = Process()
process.executableURL = URL(fileURLWithPath: trustedConverterPath)
process.arguments = ["--", input]

Intended analysis#

Intended reasoning: Relate the selected security contract to a source, transformation and sensitive operation. The intended check requires identity, flow and policy evidence; a suspicious API name alone does not establish exploitation. Required evidence: source, sink, trust, policy, validation, and flow facts

Assumptions and unknown#

The relevant facts must be admitted for the selected immutable build world. Unknown aliases, external effects, unsupported source forms or incomplete consumers can prevent a conclusion. Availability in this workflow is stated above; the illustration does not expand that availability.

Evidence and interpretation#

The target catalog describes the intended condition. It is not evidence of an active source-scan diagnostic.

Historical evidence at 4558458d: recovery-required (historical qualification is incomplete and needs further evidence). That evidence has not been requalified for this product revision.

How we validate checks explains the evidence boundary. Foundations separates method assumptions from implementation claims.