From 399582580fb26d42844a90ce96ecc3ffeae306d1 Mon Sep 17 00:00:00 2001 From: Lalith Chaitanya Mangalagiri Date: Tue, 11 Aug 2026 21:32:11 -0700 Subject: [PATCH 1/2] Rust: Add command injection query (CWE-078) Detects user-controlled data flowing into std::process::Command and tokio::process::Command (both command name and arguments). - Extension library with sources, sinks, and barriers - Models-as-data sinks for Command::new, .arg(), .args() (std + tokio) - Query help (.qhelp) with examples - Test cases with inline expectations Query ID: rust/command-line-injection --- .../rust/frameworks/stdlib/process.model.yml | 15 ++++ .../security/CommandInjectionExtensions.qll | 64 ++++++++++++++++ .../security/CWE-078/CommandInjection.qhelp | 40 ++++++++++ .../security/CWE-078/CommandInjection.ql | 42 +++++++++++ .../security/CWE-078/CommandInjectionBad.rs | 10 +++ .../security/CWE-078/CommandInjectionGood.rs | 13 ++++ .../security/CWE-078/CommandInjection.qlref | 4 + .../test/query-tests/security/CWE-078/main.rs | 75 +++++++++++++++++++ .../query-tests/security/CWE-078/options.yml | 4 + 9 files changed, 267 insertions(+) create mode 100644 rust/ql/lib/codeql/rust/frameworks/stdlib/process.model.yml create mode 100644 rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll create mode 100644 rust/ql/src/queries/security/CWE-078/CommandInjection.qhelp create mode 100644 rust/ql/src/queries/security/CWE-078/CommandInjection.ql create mode 100644 rust/ql/src/queries/security/CWE-078/CommandInjectionBad.rs create mode 100644 rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs create mode 100644 rust/ql/test/query-tests/security/CWE-078/CommandInjection.qlref create mode 100644 rust/ql/test/query-tests/security/CWE-078/main.rs create mode 100644 rust/ql/test/query-tests/security/CWE-078/options.yml diff --git a/rust/ql/lib/codeql/rust/frameworks/stdlib/process.model.yml b/rust/ql/lib/codeql/rust/frameworks/stdlib/process.model.yml new file mode 100644 index 000000000000..0187f073d679 --- /dev/null +++ b/rust/ql/lib/codeql/rust/frameworks/stdlib/process.model.yml @@ -0,0 +1,15 @@ +extensions: + - addsTo: + pack: codeql/rust-all + extensible: sinkModel + data: + # std::process::Command - the command name itself + - ["::new", "Argument[0]", "command-injection", "manual"] + # std::process::Command - arguments passed to the command + - ["::arg", "Argument[0]", "command-injection", "manual"] + - ["::args", "Argument[0]", "command-injection", "manual"] + # tokio::process::Command - the command name itself + - ["::new", "Argument[0]", "command-injection", "manual"] + # tokio::process::Command - arguments passed to the command + - ["::arg", "Argument[0]", "command-injection", "manual"] + - ["::args", "Argument[0]", "command-injection", "manual"] diff --git a/rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll b/rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll new file mode 100644 index 000000000000..7e0150d53f66 --- /dev/null +++ b/rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll @@ -0,0 +1,64 @@ +/** + * Provides classes and predicates for reasoning about command injection + * vulnerabilities (CWE-078). + */ + +import rust +private import codeql.rust.dataflow.DataFlow +private import codeql.rust.dataflow.FlowSink +private import codeql.rust.dataflow.FlowBarrier +private import codeql.rust.Concepts +private import codeql.rust.security.Barriers as Barriers + +/** + * Provides default sources, sinks and barriers for detecting command injection + * vulnerabilities, as well as extension points for adding your own. + */ +module CommandInjection { + /** + * A data flow source for command injection vulnerabilities. + */ + abstract class Source extends DataFlow::Node { } + + /** + * A data flow sink for command injection vulnerabilities. + */ + abstract class Sink extends QuerySink::Range { + override string getSinkType() { result = "CommandInjection" } + } + + /** + * A barrier for command injection vulnerabilities. + */ + abstract class Barrier extends DataFlow::Node { } + + /** + * An active threat-model source, considered as a flow source. + */ + private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { } + + /** + * A sink for command injection from model data. + */ + private class ModelsAsDataSink extends Sink { + ModelsAsDataSink() { sinkNode(this, "command-injection") } + } + + /** + * A barrier for command injection from model data. + */ + private class ModelsAsDataBarrier extends Barrier { + ModelsAsDataBarrier() { barrierNode(this, "command-injection") } + } + + /** + * A barrier for command injection vulnerabilities for nodes whose type is a + * numeric type, which is unlikely to expose any vulnerability. + */ + private class NumericTypeBarrier extends Barrier instanceof Barriers::NumericTypeBarrier { } + + private class BooleanTypeBarrier extends Barrier instanceof Barriers::BooleanTypeBarrier { } + + private class FieldlessEnumTypeBarrier extends Barrier instanceof Barriers::FieldlessEnumTypeBarrier + { } +} diff --git a/rust/ql/src/queries/security/CWE-078/CommandInjection.qhelp b/rust/ql/src/queries/security/CWE-078/CommandInjection.qhelp new file mode 100644 index 000000000000..3e7b336090b4 --- /dev/null +++ b/rust/ql/src/queries/security/CWE-078/CommandInjection.qhelp @@ -0,0 +1,40 @@ + + + + +

+If a system command is built from user-provided data without sufficient sanitization, a user may be able to run malicious commands. An attacker can craft input to change the meaning of the command, potentially gaining control of the system. +

+ + + + +

+If possible, use hard-coded string literals for commands. If the command must be built from user-provided data, do not pass user input directly to shell commands. Instead, use APIs that accept command arguments as separate parameters (such as std::process::Command with individual .arg() calls for each argument), which avoids shell interpretation of special characters. If shell execution is necessary, validate and sanitize user input against an allowlist of permitted values. +

+ + + + +

+In the following example, a command is constructed directly from user-controlled input obtained via an HTTP request. An attacker could supply a malicious value to execute arbitrary commands. +

+ + + +

+A safer approach uses a fixed command with validated arguments, or avoids shell interpretation entirely: +

+ + + + + + +
  • OWASP: Command Injection.
    • +
  • Wikipedia: Shell injection.
    • + +     +     diff --git a/rust/ql/src/queries/security/CWE-078/CommandInjection.ql b/rust/ql/src/queries/security/CWE-078/CommandInjection.ql new file mode 100644 index 000000000000..b6e93a8d88a1 --- /dev/null +++ b/rust/ql/src/queries/security/CWE-078/CommandInjection.ql @@ -0,0 +1,42 @@ +/** + * @name Uncontrolled command line + * @description Using externally controlled strings in a command line may allow a malicious + * user to change the meaning of the command. + * @kind path-problem + * @problem.severity error + * @security-severity 9.8 + * @precision high + * @id rust/command-line-injection + * @tags security + * external/cwe/cwe-078 + * external/cwe/cwe-088 + */ + +import rust +import codeql.rust.dataflow.DataFlow +import codeql.rust.dataflow.TaintTracking +import codeql.rust.security.CommandInjectionExtensions + +/** + * A taint configuration for detecting command injection vulnerabilities. + */ +module CommandInjectionConfig implements DataFlow::ConfigSig { + import CommandInjection + + predicate isSource(DataFlow::Node node) { node instanceof Source } + + predicate isSink(DataFlow::Node node) { node instanceof Sink } + + predicate isBarrier(DataFlow::Node barrier) { barrier instanceof Barrier } + + predicate observeDiffInformedIncrementalMode() { any() } +} + +module CommandInjectionFlow = TaintTracking::Global; + +import CommandInjectionFlow::PathGraph + +from CommandInjectionFlow::PathNode sourceNode, CommandInjectionFlow::PathNode sinkNode +where CommandInjectionFlow::flowPath(sourceNode, sinkNode) +select sinkNode.getNode(), sourceNode, sinkNode, "This command line depends on a $@.", + sourceNode.getNode(), "user-provided value" diff --git a/rust/ql/src/queries/security/CWE-078/CommandInjectionBad.rs b/rust/ql/src/queries/security/CWE-078/CommandInjectionBad.rs new file mode 100644 index 000000000000..fa81cef9fe15 --- /dev/null +++ b/rust/ql/src/queries/security/CWE-078/CommandInjectionBad.rs @@ -0,0 +1,10 @@ +use std::process::Command; + +fn handle_request(user_input: &str) { + // BAD: user input is passed directly to a shell command + Command::new("sh") + .arg("-c") + .arg(user_input) + .output() + .expect("failed to execute"); +} diff --git a/rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs b/rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs new file mode 100644 index 000000000000..bb720d39d03e --- /dev/null +++ b/rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs @@ -0,0 +1,13 @@ +use std::process::Command; + +fn handle_request(filename: &str) { + // GOOD: use a fixed command with the user input as a separate argument, + // avoiding shell interpretation + let allowed_names = ["report.pdf", "summary.txt", "data.csv"]; + if allowed_names.contains(&filename) { + Command::new("cat") + .arg(filename) + .output() + .expect("failed to execute"); + } +} diff --git a/rust/ql/test/query-tests/security/CWE-078/CommandInjection.qlref b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.qlref new file mode 100644 index 000000000000..3b14f15fafe6 --- /dev/null +++ b/rust/ql/test/query-tests/security/CWE-078/CommandInjection.qlref @@ -0,0 +1,4 @@ +query: queries/security/CWE-078/CommandInjection.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/rust/ql/test/query-tests/security/CWE-078/main.rs b/rust/ql/test/query-tests/security/CWE-078/main.rs new file mode 100644 index 000000000000..eecf95cec33d --- /dev/null +++ b/rust/ql/test/query-tests/security/CWE-078/main.rs @@ -0,0 +1,75 @@ +use std::process::Command; + +fn test_std_command_injection() { + let arg_string = std::env::args().nth(1).unwrap_or(String::from("ls")); // $ Source=args1 + let remote_string = reqwest::blocking::get("http://example.com/") // $ Source=remote1 + .unwrap() + .text() + .unwrap_or(String::from("ls")); + let const_string = String::from("echo hello"); + + // --- safe cases --- + + // Constant command and argument + Command::new("ls") + .arg("-la") + .output() + .expect("failed"); // safe + + // Constant constructed command + Command::new(const_string.as_str()) + .output() + .expect("failed"); // safe + + // --- unsafe cases --- + + // User input as the command itself + Command::new(arg_string.as_str()) // $ Alert[rust/command-line-injection]=args1 + .output() + .expect("failed"); + + // User input as an argument to sh -c + Command::new("sh") + .arg("-c") + .arg(remote_string.as_str()) // $ Alert[rust/command-line-injection]=remote1 + .output() + .expect("failed"); + + // User input as an argument + Command::new("grep") + .arg(arg_string.as_str()) // $ Alert[rust/command-line-injection]=args1 + .arg("file.txt") + .output() + .expect("failed"); + + // Remote input via args() + Command::new("bash") + .args(&["-c", remote_string.as_str()]) // $ Alert[rust/command-line-injection]=remote1 + .output() + .expect("failed"); +} + +async fn test_tokio_command_injection() { + let remote_string = reqwest::blocking::get("http://example.com/") // $ Source=remote2 + .unwrap() + .text() + .unwrap_or(String::from("ls")); + + // Unsafe: remote input as tokio command + let _output = tokio::process::Command::new(remote_string.as_str()) // $ Alert[rust/command-line-injection]=remote2 + .output() + .await + .expect("failed"); + + // Unsafe: remote input as tokio command argument + tokio::process::Command::new("sh") + .arg("-c") + .arg(remote_string.as_str()) // $ Alert[rust/command-line-injection]=remote2 + .output() + .await + .expect("failed"); +} + +fn main() { + test_std_command_injection(); +} diff --git a/rust/ql/test/query-tests/security/CWE-078/options.yml b/rust/ql/test/query-tests/security/CWE-078/options.yml new file mode 100644 index 000000000000..78cb2f883af1 --- /dev/null +++ b/rust/ql/test/query-tests/security/CWE-078/options.yml @@ -0,0 +1,4 @@ +qltest_cargo_check: true +qltest_dependencies: + - reqwest = { version = "0.12.9", features = ["blocking"] } + - tokio = { version = "1", features = ["full"] } From 22ab3706421e309879fcf84143b1f4e5ecfb4de0 Mon Sep 17 00:00:00 2001 From: Lalith Chaitanya Mangalagiri Date: Tue, 11 Aug 2026 21:49:23 -0700 Subject: [PATCH 2/2] Add change note for rust/command-line-injection query --- rust/ql/src/change-notes/2026-08-11-command-injection.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 rust/ql/src/change-notes/2026-08-11-command-injection.md diff --git a/rust/ql/src/change-notes/2026-08-11-command-injection.md b/rust/ql/src/change-notes/2026-08-11-command-injection.md new file mode 100644 index 000000000000..2175cc9cdf18 --- /dev/null +++ b/rust/ql/src/change-notes/2026-08-11-command-injection.md @@ -0,0 +1,4 @@ +--- +category: newQuery +--- +* Added a new query, `rust/command-line-injection`, to detect uncontrolled command lines.