thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

OS Command Injection Prevention

Defenses that prevent user input from being executed as operating system commands.

Definition

Best practice is to avoid shell calls entirely and use native library APIs. If a command is necessary, pass arguments as an array without a shell, allowlist permitted values and run with least privilege. Escaping is a fallback only.

Example

Using a language's file API to delete a file instead of invoking a shell with the filename.

Exam tip

Avoid the shell altogether; parameterized exec without a shell is next best.

Related terms