
BKOSHY175496 (Community Member) asked a question.
I am getting OS Command injection with Flaw Id 380 for the below code. Could you please suggest what correction I need to make to make the scan success.
private void _CreateMolButton_Click(object sender, EventArgs e)
{
if (string.IsNullOrWhiteSpace(this._InputFileTextBox.Text) || string.IsNullOrWhiteSpace(this._OutputLocationTextBox.Text))
{
MessageBox.Show("Please specify SD file or the output path", "SDF Molfile Writer", MessageBoxButtons.OK, MessageBoxIcon.Stop);
return;
}
try
{
_CreateMolButton.Enabled = false;
_toolStripStatusLabel.Text = "Processing SDF File...";
this.Cursor = Cursors.WaitCursor;
this.Height = 197;
// Validate and sanitize user inputs
string inputFile = Path.GetFullPath(this._InputFileTextBox.Text);
string outputLocation = Path.GetFullPath(this._OutputLocationTextBox.Text);
string logFileName = Path.GetFileNameWithoutExtension(outputLocation) + ".log";
if (File.Exists(inputFile) && (Path.GetExtension(inputFile).Equals(".sdf") || Path.GetExtension(inputFile).Equals(".sd") && Directory.Exists(outputLocation)))
{
sdfMolfileWriter.MolfileWriter(inputFile, this.comboSDFNameField.Text, outputLocation, logFileName, _toolStripStatusLabel);
_toolStripStatusLabel.Text = "Processing Completed.";
Application.DoEvents();
if (MessageBox.Show("Created Mol files successfully. Do you want to view this in folder?", "SDF Utility", MessageBoxButtons.YesNo, MessageBoxIcon.Question) == DialogResult.Yes)
{
ProcessStartInfo startInfo = new ProcessStartInfo
{
FileName = outputLocation,
UseShellExecute = true,
};
using (Process process = new Process())
{
process.StartInfo = startInfo;
process.Start();
}
}
}
else
{
MessageBox.Show("Error: Invalid file path or directory not exists", "SDF Molfile Writer", MessageBoxButtons.OK, MessageBoxIcon.Error);
}
_CreateMolButton.Enabled = true;
this.Cursor = Cursors.Default;
this.Height = 176;
}
catch (Exception ex)
{
MessageBox.Show("Error: " + ex.Message, "SDF Molfile Writer", MessageBoxButtons.OK, MessageBoxIcon.Error);
this.Height = 176;
this.Cursor = Cursors.Default;
this.Close();
}
}
.png)
hello @BKOSHY175496 (Community Member)
Veracode has a very good documentation for C# that called remediantion guidance, specialized in helping how to deep dive into a vulnerability and fix it.
You can see on Veracode Platform > Triage Flaws > expand the flaw (black triangle) > Remediation Guidance link.
Here is the URL of Remediation Guidance related to OS Command Injection that you can look, understand and try to apply into your code: downloads.veracode.com/securityscan/cwe/v5/net/78.html#example
I'm sending a OWASP cheet sheet that can help you too
https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#os-injection
Otherwise, if you have any difficult, contact Veracode Support to help you.