Command injection and process argument boundaries

Mechanism

Command injection mixes data with shell syntax. Passing an argument array directly to a process avoids shell metacharacter interpretation, but an executable can still interpret dangerous options or special filenames. Determine whether the application invokes a shell, which shell it uses, and whether the controlled value occupies a command, argument, redirection, or environment position.

Practical method

Locate a field that influences an external tool and record its expected output. Use a benign distinguishing argument in the local challenge environment. Compare quoting behavior and error messages to identify the parsing layer. When output is hidden, prefer a controlled local side effect over noisy timing assumptions. Inspect whether a leading dash can become an option.

import subprocess
# No shell interpolation; -- ends options for tools supporting it.
subprocess.run(["grep", "-F", "--", needle, "fixture.txt"],
               check=False, capture_output=True, text=True)

Interpreting evidence

A process error can reveal a command template without establishing injection. Confirm that your controlled input changes process semantics and distinguish shell execution from argument injection. Record executable version, working directory, and inherited privileges.

Pitfalls and limits

Quoting is shell-specific and can break when nested. A shell-free invocation still needs input constraints appropriate to the target program. Windows command parsing differs between cmd.exe, PowerShell, and runtime argument construction.