Prevent Command Injection for Go

Documentation Index

Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt

Use this file to discover all available pages before exploring further.

​

Check your project using Semgrep

semgrep --config auto .

​

1. Running an OS command

​

1.A. Running OS commands with exec.Command()

package main

import "os/exec"

func main() {
  // Command example
  cmd := exec.Command("echo", "hello")

  // CommandContext example
  err := exec.CommandContext(ctx, "sleep", "5").Run()

  // Not vulnerable
  cmd := exec.Command("echo", "1; cat /etc/passwd")

  // Vulnerable
  userInput :=  "echo 1 | cat /etc/passwd" // value supplied by user input
  out, _ = exec.Command("sh", "-c", userInput).Output()

  // Vulnerable
  userInput1 := "cat" // value supplied by user input
  userInput2 := "/etc/passwd" // value supplied by user input
  out, _ = exec.Command(userInput1, userInput2)
}

​

References

• Command documentation
• CommandContext documentation

​

Mitigation

• Always try to use internal Go API (if it exists) instead of running an OS command. In other words, use internal language features instead of invoking commands that can be exploited.
• Do not include command arguments in a command string, use parameterization instead. For example:
  Use:
  exec.Command("/path/to/myCommand", "myArg1", inputValue)
  
  Instead of:
  exec.Command("bash", "-c", "myCommand myArg1 " + inputValue)
  
• If it is not possible, then strip everything except alphanumeric characters from an input provided for the command string and arguments.
• Try to avoid non-literal values for the command string.
• If it is not possible, then do not let running arbitrary commands, use an allowlist for inputs.

​

Semgrep rule

​

1.B. Creating exec.Cmd struct

package main

import (
  "os/exec"
  "os"
)

func main() {
  cmd := &exec.Cmd {
    // Path is the path of the command to run.
    Path: "/bin/echo",
    // Args holds command line arguments, including the command itself as Args[0].
    Args: []string{ "echo", "hello world" },
    Stdout: os.Stdout,
    Stderr: os.Stdout,
  }
  cmd.Start();
  cmd.Wait();

  // Args can be also omitted and {Path} will be used by default
  cmd := &exec.Cmd {
    Path: "/bin/echo"
  }

  // Vulnerable
  userInput := "/pwn/exploit" // value supplied by user input
  cmd := &exec.Cmd {
    Path: userInput
  }

  // Vulnerable
  userInput1 := "/bin/bash" // value supplied by user input
  userInput2 := []string{ "bash", "exploit.sh" } // value supplied by user input
  cmd := &exec.Cmd {
    Path: userInput1,
    Args: userInput2
  }

}

​

References

• Cmd struct documentation

​

Mitigation

• Always try to use internal Go API (if it exists) instead of running an OS command.
• Try to avoid non-literal values for the command string.
• If it is not possible, then do not let running arbitrary commands, use an allowlist for inputs.
• Do not include command arguments in a command string, use parameterization instead. For example:
  Use:
  cmd := &exec.Cmd {
    Path: "/path/to/myCommand",
    Args: []string{ "myCommand", "myArg1", inputValue },
  }
  
  Instead of:
  cmd := &exec.Cmd {
    Path: "/bin/bash",
    Args: []string{ "bash", "-c", "myCommand myArg1 " + inputValue },
  }
  
• If it is not possible - strip everything except alphanumeric characters from an input provided for the command string and arguments.

​

Semgrep rule

​

1.C. Writing to a command’s StdinPipe

package main

import (
  "fmt"
  "os/exec"
)

func main() {
  cmd := exec.Command("bash")
  // StdinPipe initialization
  cmdWriter, _ := cmd.StdinPipe() 
  cmd.Start()
  // Vulnerability when `password` controlled by user input
  cmdInput := fmt.Sprintf("sshpass -p %s", password)
  // Writing to StdinPipe
  cmdWriter.Write([]byte(cmdInput + "\n"))
  cmd.Wait()
}

​

References

• Cmd.StdinPipe documentation

​

Mitigation

• Always try to use internal Go API (if it exists) instead of running an OS command.
• Do not use it to run the bash command and to avoid non-literal values for the command string.
• If it is not possible, then do not let running arbitrary commands, use a white list for inputs.
• Strip everything except alphanumeric characters from an input provided for the StdinPipe input.

​

Semgrep rule

​

1.D. Running OS commands with syscall.Exec()

package main

import "syscall"
import "os"
import "os/exec"

// Exec invokes the execve(2) system call.
syscall.Exec(binary, args, env)
// ForkExec - combination of fork and exec, careful to be thread safe.
syscall.ForkExec(binary, args, env)

func vulnerableCode(userInput string) {
  //  Vulnerable: Do not let `path` be defined by user input
  path, _ := exec.LookPath(userInput)
  args := []string{"ls", "-a", "-l", "-h"}
  env := os.Environ()
  execErr := syscall.Exec(path, args, env)
}

​

References

• Exec documentation
• ForkExec documentation

​

Mitigation

• Always try to use internal Go API (if it exists) instead of running an OS command.
• Try to avoid non-literal values for the command string.
• If it is not possible, then do not let running arbitrary commands, use an allowlist for inputs.
• Do not include command arguments in a command string, use parameterization instead. For example:
  Use:
  syscall.Exec("/path/to/myCommand", []string{"myCommand", "myArg1", inputValue}, env)
  
  Instead of:
  syscall.Exec("/bin/bash", []string{"bash", "-c", "myCommand myArg1 " + inputValue}, env)
  
• If it is not possible - strip everything except alphanumeric characters from an input provided for the command string and arguments.

​

Semgrep rule