We previously had a process call flagged with an OS command injection flaw (CWE-78), due to an unchecked argument list to Process.Start().

It has now been updated to protect against unintended/malicious argument content, but static scans still flag with the same issue.

(e.g. Following suggestions from https://dotnet-security-guard.github.io/SG0001.htm)

The program flow cannot reach the process call unless its arguments pass our constraints. Is there anything else that needs to be addressed before this flaw would be considered resolved? Or, do we need to propose mitigation?

Here's a simplified version of the code:

// Written in C#

public static MyMethod(arg1, arg2, arg3)

{

   try

   {

       //

       // Added validation

       //

       Regex checkArg1 = new Regex(/* some pattern */);

       if (!checkIArg1.IsMatch(arg1))

       {

           throw new ArgumentException("Invalid format", "arg1");

       }

       Regex checkArg2 = new Regex(/* another pattern */);

       if (!checkIArg2.IsMatch(arg2))

       {

           throw new ArgumentException("Invalid format", "arg2");

       }

       Regex checkArg3 = new Regex(/* another pattern */);

       if (!checkIArg3.IsMatch(arg3))

       {

           throw new ArgumentException("Invalid format", "arg3");

       }

        if (checkArg1.IsMatch(arg1) && checkArg1.IsMatch(arg2) && checkArg1.IsMatch(arg3))

       {

           //

           // Start original code block

           //

           Process proc = new Process();

           proc.StartInfo.FileName = MyExe;

           proc.StartInfo.Arguments = string.Format("{0} {1} {2}", arg1, arg2, arg3);

           // ... do things ...

           proc.Start();   // <--- OS command injection flagged here

           // ... do things ...

           proc.Close();

           //

           // end block

           //

       }

   }

   catch (Exception ex)

   {

       /* Do things */

   }

}