Hi @SChilukuri209842 (Community Member)​,

I can't think of a scenario where URL Encoding alone would be sufficient as mitigation for an OS Command Injection finding. Additional validation in form of an allow-list or a regex is always highly recommended. If your question is of a general nature on how to address OS Command Injection, it might be a good start to read through the following:

• https://www.veracode.com/security/java/cwe-78
• https://www.veracode.com/security/dotnet/cwe-78
• https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html

If you have a question regarding a concrete code snippet, e.g. a finding reported by Veracode Static Analysis, we are happy to provide you with custom remediation advice. For this, please provide us with as much information as possible such as the code the finding is reported on, additional information from the Flaw Details in the Triage Flaws view (to open the flaw details, you would have to navigate to the Triage Flaws view and click on the black triangle pointing right just next to a flaw ID), etc.

Thank you,

Florian Walter

Hi @SChilukuri209842 (Community Member)​ 

I would recommend adding the validation of the given command and arguments.

Encoding URL alone is not sufficient and for sure does prevent you from OS Command Injection possibilities.

The article explains how you make use of an allowlist approach to mitigate the issue:

https://community.veracode.com/s/article/allowlist-helps-fix-cwe

Regards

Kashif.