Dynamic Shell Command Execution Across Polyglot Process APIs

Remediation checklist

• Go: invoke exec.CommandContext(ctx, binary, arg1, arg2, ...) directly without sh -c; TypeScript & JavaScript: use child_process.execFile / execFileSync(binary, args, { shell: false }) instead of exec/execSync.
• Python: call subprocess.run([binary, *args], shell=False, check=True) instead of os.system or shell=True; Java & Kotlin: pass discrete List/vararg elements to ProcessBuilder(binary, arg1, ...) instead of Runtime.exec(cmd) or sh -c.
• C#: configure ProcessStartInfo with UseShellExecute = false and populate ArgumentList; Rust: use std::process::Command::new(binary).args([...]) without routing through sh -c; C/C++: use posix_spawnp or execve with discrete argv[] instead of system()/popen().
• Ruby: pass multiple discrete string arguments to system(binary, *args) or Open3.capture2e(binary, *args) instead of interpolated single strings or backticks; PHP: pass a PHP 7.4+ argv array to proc_open([$binary, $arg], ...) or Symfony new Process([$binary, $arg]); Swift: set Foundation.Process.executableURL directly to the target binary with discrete arguments.
• Precede positional operands with '--' on flag-accepting tools (git, tar, ssh, grep) so untrusted values starting with '-' cannot inject option flags.

Illustrative Code Examples

These fragments explain migration direction. They are not complete applications or compiler-verified patches for your project.

// Go: shell interpreter with dynamic command
out, err := exec.CommandContext(ctx, "sh", "-c", "git show "+rev).CombinedOutput()

# Ruby: single-string system() invokes /bin/sh
system("convert #{input_path} #{output_path}")

// PHP: shell_exec invokes /bin/sh -c
$out = shell_exec("whois " . $domain);

// Go: direct execve argv array + '--' option terminator
if strings.HasPrefix(rev, "-") { return nil, fmt.Errorf("invalid rev") }
out, err := exec.CommandContext(ctx, "git", "show", rev, "--").CombinedOutput()

# Ruby: multi-argument system() bypasses /bin/sh
system("convert", "--", input_path, output_path)

// PHP: array-form proc_open bypasses the shell
$proc = proc_open(['whois', '--', $domain], [1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes);