Hi @GSilva849776 (Community Member)​,

The first recommendation to deal with OS Command Injection findings is always to make sure if it's absolutely required to execute OS Commands. Often, it is possible to avoid them by using existing APIs. It seems to me that e.g. the call to `/bin/cat` can be replaced by using the File API to open the corresponding file.

If it is absolutely required to execute OS commands, we would always recommend against using `system()` since it invokes a fully-grown shell. If possible, always use a function from the `exec` family instead, like `execl()` / `execve()`. The `exec` family of functions does not use a full shell interpreter but just executes the program passed to it. Also, e.g. `execl()` separates the command from its arguments (https://linux.die.net/man/3/execl).

Furthermore, please make sure to validate all dynamic arguments when invoking OS commands. This makes sure that the downstream applications (i.e., `/bin/cat` and `/bin/vqfds`) are protected as well.

It's also important to make sure that the program runs with the lowest privileges required to perform its job. This is of course always important but even more important for programs that execute OS commands based on data from outside the application.

Please note that Veracode Static Analysis would not be able to verify dynamic validations, such as regular expressions, and you would have to propose a mitigation by design once you have appropriate security controls in place. For more information on how to do that, please refer to our Help Center: https://docs.veracode.com/r/improve_mitigation .

Thank you,

Florian Walter