exec-injection
Arguments are not interpreted by a shell
The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain exec-injection.
- pack
execopt-in pack- weight
- critical
- scope
- server (no shell in argument passing; shell-style tools that take one command line are not tested, they are a shell by design)
- decided by
- fs-observerresponse
- since
- 0.2-draft (methodology 0.3-draft)
- config keys
activechecks.exec-injection.corpus.addchecks.exec-injection.corpus.removechecks.exec-injection.enabledchecks.exec-injection.severity
Probes
inj-1program sm-echo, one argument: <token>; sm-canaryinj-2program sm-echo, one argument: <token> && sm-canaryinj-3program sm-echo, one argument: <token> | sm-canaryinj-4program sm-echo, one argument: <token>$(sm-canary)inj-5program sm-echo, one argument: <token>`sm-canary`inj-6program sm-echo, one argument: <token> & sm-canary
Settings and thresholds
Every check also takes checks.exec-injection.enabled and checks.exec-injection.severity; they are described once in the configuration reference.
This check has no numeric threshold.
| Key | Default | Standard | Meaning |
|---|---|---|---|
checks.exec-injection.corpus.add | [] | locked | Extra probes for exec-injection, validated against the pack's corpus schema. Appends across layers. Any addition makes the run CUSTOM. |
checks.exec-injection.corpus.remove | [] | locked | Probe ids or exact strings to drop from the exec-injection corpus. Appends across layers. Any removal makes the run CUSTOM. |
active | false | not locked | Allow the exec pack and active custom probes to run harness-owned programs. Only the --active flag can set it; files and environment cannot. |
How the verdict is established
- Scoring. critical and scored: pass = 1 point, part = 0.5, fail = 0. A fail caps the pack's grade at D, whatever the other checks scored.
What to fix
Start programs with an argument list and no shell (execFile, or spawn without shell: true), and validate arguments rather than building a command string.
False positives
A server that deliberately runs argument lists through a shell is reported as failing; that is the finding.
False negatives
On Windows a shell does not treat `;`, `$()` or backticks as separators, so only `&&`, `&` and `|` can fire there. Interpreters other than the platform shell are not exercised.