BKOSHY175496 (Community Member) asked a question.

Flaw Id - 380 in my C# code

I am getting OS Command injection with Flaw Id 380 for the below code. Could you please suggest what correction I need to make to make the scan success.

 

private void _CreateMolButton_Click(object sender, EventArgs e)

    {

      if (string.IsNullOrWhiteSpace(this._InputFileTextBox.Text) || string.IsNullOrWhiteSpace(this._OutputLocationTextBox.Text))

      {

        MessageBox.Show("Please specify SD file or the output path", "SDF Molfile Writer", MessageBoxButtons.OK, MessageBoxIcon.Stop);

        return;

      }

      try

      {

        _CreateMolButton.Enabled = false;

        _toolStripStatusLabel.Text = "Processing SDF File...";

        this.Cursor = Cursors.WaitCursor;

        this.Height = 197;

 

        // Validate and sanitize user inputs

        string inputFile = Path.GetFullPath(this._InputFileTextBox.Text);

        string outputLocation = Path.GetFullPath(this._OutputLocationTextBox.Text);

        string logFileName = Path.GetFileNameWithoutExtension(outputLocation) + ".log";

 

        if (File.Exists(inputFile) && (Path.GetExtension(inputFile).Equals(".sdf") || Path.GetExtension(inputFile).Equals(".sd") && Directory.Exists(outputLocation)))

        {

          sdfMolfileWriter.MolfileWriter(inputFile, this.comboSDFNameField.Text, outputLocation, logFileName, _toolStripStatusLabel);

          _toolStripStatusLabel.Text = "Processing Completed.";

          Application.DoEvents();

 

          if (MessageBox.Show("Created Mol files successfully. Do you want to view this in folder?", "SDF Utility", MessageBoxButtons.YesNo, MessageBoxIcon.Question) == DialogResult.Yes)

          {

            ProcessStartInfo startInfo = new ProcessStartInfo

            {

              FileName = outputLocation,

              UseShellExecute = true,

            };

            using (Process process = new Process())

            {

              process.StartInfo = startInfo;

              process.Start();

            }

          }

        }

        else

        {

          MessageBox.Show("Error: Invalid file path or directory not exists", "SDF Molfile Writer", MessageBoxButtons.OK, MessageBoxIcon.Error);

        }

        _CreateMolButton.Enabled = true;

        this.Cursor = Cursors.Default;

        this.Height = 176;

      }

      catch (Exception ex)

      {

        MessageBox.Show("Error: " + ex.Message, "SDF Molfile Writer", MessageBoxButtons.OK, MessageBoxIcon.Error);

        this.Height = 176;

        this.Cursor = Cursors.Default;

        this.Close();

      }

    }


lucas.ferreira likes this.

Topics (4)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.