Rust: Add command injection query (CWE-078)

rust/ql/lib/codeql/rust/frameworks/stdlib/process.model.yml

@@ -0,0 +1,15 @@
+extensions:
+  - addsTo:
+      pack: codeql/rust-all
+      extensible: sinkModel
+    data:
+      # std::process::Command - the command name itself
+      - ["<std::process::Command>::new", "Argument[0]", "command-injection", "manual"]
+      # std::process::Command - arguments passed to the command
+      - ["<std::process::Command>::arg", "Argument[0]", "command-injection", "manual"]
+      - ["<std::process::Command>::args", "Argument[0]", "command-injection", "manual"]
+      # tokio::process::Command - the command name itself
+      - ["<tokio::process::Command>::new", "Argument[0]", "command-injection", "manual"]
+      # tokio::process::Command - arguments passed to the command
+      - ["<tokio::process::Command>::arg", "Argument[0]", "command-injection", "manual"]
+      - ["<tokio::process::Command>::args", "Argument[0]", "command-injection", "manual"]

rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll

@@ -0,0 +1,64 @@
+/**
+ * Provides classes and predicates for reasoning about command injection
+ * vulnerabilities (CWE-078).
+ */
+
+import rust
+private import codeql.rust.dataflow.DataFlow
+private import codeql.rust.dataflow.FlowSink
+private import codeql.rust.dataflow.FlowBarrier
+private import codeql.rust.Concepts
+private import codeql.rust.security.Barriers as Barriers
+
+/**
+ * Provides default sources, sinks and barriers for detecting command injection
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+module CommandInjection {
+  /**
+   * A data flow source for command injection vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for command injection vulnerabilities.
+   */
+  abstract class Sink extends QuerySink::Range {
+    override string getSinkType() { result = "CommandInjection" }
+  }
+
+  /**
+   * A barrier for command injection vulnerabilities.
+   */
+  abstract class Barrier extends DataFlow::Node { }
+
+  /**
+   * An active threat-model source, considered as a flow source.
+   */
+  private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
+
+  /**
+   * A sink for command injection from model data.
+   */
+  private class ModelsAsDataSink extends Sink {
+    ModelsAsDataSink() { sinkNode(this, "command-injection") }
+  }
+
+  /**
+   * A barrier for command injection from model data.
+   */
+  private class ModelsAsDataBarrier extends Barrier {
+    ModelsAsDataBarrier() { barrierNode(this, "command-injection") }
+  }
+
+  /**
+   * A barrier for command injection vulnerabilities for nodes whose type is a
+   * numeric type, which is unlikely to expose any vulnerability.
+   */
+  private class NumericTypeBarrier extends Barrier instanceof Barriers::NumericTypeBarrier { }
+
+  private class BooleanTypeBarrier extends Barrier instanceof Barriers::BooleanTypeBarrier { }
+
+  private class FieldlessEnumTypeBarrier extends Barrier instanceof Barriers::FieldlessEnumTypeBarrier
+  { }
+}

rust/ql/src/change-notes/2026-08-11-command-injection.md

@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new query, `rust/command-line-injection`, to detect uncontrolled command lines.

rust/ql/src/queries/security/CWE-078/CommandInjection.qhelp

@@ -0,0 +1,40 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+
+<p>
+If a system command is built from user-provided data without sufficient sanitization, a user may be able to run malicious commands. An attacker can craft input to change the meaning of the command, potentially gaining control of the system.
+</p>
+
+</overview>
+<recommendation>
+
+<p>
+If possible, use hard-coded string literals for commands. If the command must be built from user-provided data, do not pass user input directly to shell commands. Instead, use APIs that accept command arguments as separate parameters (such as <code>std::process::Command</code> with individual <code>.arg()</code> calls for each argument), which avoids shell interpretation of special characters. If shell execution is necessary, validate and sanitize user input against an allowlist of permitted values.
+</p>
+
+</recommendation>
+<example>
+
+<p>
+In the following example, a command is constructed directly from user-controlled input obtained via an HTTP request. An attacker could supply a malicious value to execute arbitrary commands.
+</p>
+
+<sample src="CommandInjectionBad.rs" />
+
+<p>
+A safer approach uses a fixed command with validated arguments, or avoids shell interpretation entirely:
+</p>
+
+<sample src="CommandInjectionGood.rs" />
+
+</example>
+<references>
+
+<li>OWASP: <a href="https://owasp.org/www-community/attacks/Command_Injection">Command Injection</a>.</li>
+<li>Wikipedia: <a href="https://en.wikipedia.org/wiki/Code_injection#Shell_injection">Shell injection</a>.</li>
+
+</references>
+</qhelp>

rust/ql/src/queries/security/CWE-078/CommandInjection.ql

@@ -0,0 +1,42 @@
+/**
+ * @name Uncontrolled command line
+ * @description Using externally controlled strings in a command line may allow a malicious
+ *              user to change the meaning of the command.
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 9.8
+ * @precision high
+ * @id rust/command-line-injection
+ * @tags security
+ *       external/cwe/cwe-078
+ *       external/cwe/cwe-088
+ */
+
+import rust
+import codeql.rust.dataflow.DataFlow
+import codeql.rust.dataflow.TaintTracking
+import codeql.rust.security.CommandInjectionExtensions
+
+/**
+ * A taint configuration for detecting command injection vulnerabilities.
+ */
+module CommandInjectionConfig implements DataFlow::ConfigSig {
+  import CommandInjection
+
+  predicate isSource(DataFlow::Node node) { node instanceof Source }
+
+  predicate isSink(DataFlow::Node node) { node instanceof Sink }
+
+  predicate isBarrier(DataFlow::Node barrier) { barrier instanceof Barrier }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+}
+
+module CommandInjectionFlow = TaintTracking::Global<CommandInjectionConfig>;
+
+import CommandInjectionFlow::PathGraph
+
+from CommandInjectionFlow::PathNode sourceNode, CommandInjectionFlow::PathNode sinkNode
+where CommandInjectionFlow::flowPath(sourceNode, sinkNode)
+select sinkNode.getNode(), sourceNode, sinkNode, "This command line depends on a $@.",
+  sourceNode.getNode(), "user-provided value"

rust/ql/src/queries/security/CWE-078/CommandInjectionBad.rs

@@ -0,0 +1,10 @@
+use std::process::Command;
+
+fn handle_request(user_input: &str) {
+    // BAD: user input is passed directly to a shell command
+    Command::new("sh")
+        .arg("-c")
+        .arg(user_input)
+        .output()
+        .expect("failed to execute");
+}

rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs

@@ -0,0 +1,13 @@
+use std::process::Command;
+
+fn handle_request(filename: &str) {
+    // GOOD: use a fixed command with the user input as a separate argument,
+    // avoiding shell interpretation
+    let allowed_names = ["report.pdf", "summary.txt", "data.csv"];
+    if allowed_names.contains(&filename) {
+        Command::new("cat")
+            .arg(filename)
+            .output()
+            .expect("failed to execute");
+    }
+}

rust/ql/test/query-tests/security/CWE-078/CommandInjection.qlref

@@ -0,0 +1,4 @@
+query: queries/security/CWE-078/CommandInjection.ql
+postprocess:
+ - utils/test/PrettyPrintModels.ql
+ - utils/test/InlineExpectationsTestQuery.ql

rust/ql/test/query-tests/security/CWE-078/main.rs

@@ -0,0 +1,75 @@
+use std::process::Command;
+
+fn test_std_command_injection() {
+    let arg_string = std::env::args().nth(1).unwrap_or(String::from("ls")); // $ Source=args1
+    let remote_string = reqwest::blocking::get("http://example.com/") // $ Source=remote1
+        .unwrap()
+        .text()
+        .unwrap_or(String::from("ls"));
+    let const_string = String::from("echo hello");
+
+    // --- safe cases ---
+
+    // Constant command and argument
+    Command::new("ls")
+        .arg("-la")
+        .output()
+        .expect("failed"); // safe
+
+    // Constant constructed command
+    Command::new(const_string.as_str())
+        .output()
+        .expect("failed"); // safe
+
+    // --- unsafe cases ---
+
+    // User input as the command itself
+    Command::new(arg_string.as_str()) // $ Alert[rust/command-line-injection]=args1
+        .output()
+        .expect("failed");
+
+    // User input as an argument to sh -c
+    Command::new("sh")
+        .arg("-c")
+        .arg(remote_string.as_str()) // $ Alert[rust/command-line-injection]=remote1
+        .output()
+        .expect("failed");
+
+    // User input as an argument
+    Command::new("grep")
+        .arg(arg_string.as_str()) // $ Alert[rust/command-line-injection]=args1
+        .arg("file.txt")
+        .output()
+        .expect("failed");
+
+    // Remote input via args()
+    Command::new("bash")
+        .args(&["-c", remote_string.as_str()]) // $ Alert[rust/command-line-injection]=remote1
+        .output()
+        .expect("failed");
+}
+
+async fn test_tokio_command_injection() {
+    let remote_string = reqwest::blocking::get("http://example.com/") // $ Source=remote2
+        .unwrap()
+        .text()
+        .unwrap_or(String::from("ls"));
+
+    // Unsafe: remote input as tokio command
+    let _output = tokio::process::Command::new(remote_string.as_str()) // $ Alert[rust/command-line-injection]=remote2
+        .output()
+        .await
+        .expect("failed");
+
+    // Unsafe: remote input as tokio command argument
+    tokio::process::Command::new("sh")
+        .arg("-c")
+        .arg(remote_string.as_str()) // $ Alert[rust/command-line-injection]=remote2
+        .output()
+        .await
+        .expect("failed");
+}
+
+fn main() {
+    test_std_command_injection();
+}

rust/ql/test/query-tests/security/CWE-078/options.yml

@@ -0,0 +1,4 @@
+qltest_cargo_check: true
+qltest_dependencies:
+    - reqwest = { version = "0.12.9", features = ["blocking"] }
+    - tokio = { version = "1", features = ["full"] }