How to fix Command Injection
in Dart Frog

The vulnerability stems from invoking a subshell ('sh -c') which interprets shell-specific characters. In the secure version, we invoke the 'ls' binary directly and pass 'filename' as a separate argument. By setting 'runInShell: false' (the default), the operating system handles the arguments as a literal array, making it impossible for an attacker to break out of the intended command using characters like '; rm -rf /'. Always prefer direct binary execution over shell scripts and implement strict input whitelisting for extra defense-in-depth.

import 'dart:io';
import 'package:dart_frog/dart_frog.dart';
Future onRequest(RequestContext context) async {
final params = context.request.uri.queryParameters;
final filename = params[‘file’] ?? ‘default.txt’;
// SECURE: Avoid the shell. Pass arguments as a discrete list.
// This ensures the OS treats the input as a literal string, not a command.
final result = await Process.run(
‘ls’,
[‘-la’, filename],
runInShell: false,
);
return Response(body: result.stdout.toString());
}