Fix Command Injection in Echo

Command injection in Go's Echo framework occurs when untrusted user input is concatenated directly into shell execution strings. This allows an attacker to break out of the intended command and execute arbitrary code on the host OS. Real researchers don't use shell interpreters like 'sh' or 'bash' for simple tasks; they use the OS-level primitives correctly.

The Vulnerable Pattern

e.GET("/lookup", func(c echo.Context) error {
	hostname := c.QueryParam("host")
	// VULNERABLE: String concatenation into a shell command
	cmd := exec.Command("sh", "-c", "nslookup " + hostname)
	out, _ := cmd.CombinedOutput()
	return c.String(http.StatusOK, string(out))
})

The Secure Implementation

The vulnerability lies in invoking 'sh -c'. This spawns a shell process that interprets metacharacters like ';', '&', and '|'. By switching to 'exec.Command("binary", "arg1", "arg2")', Go uses the execve(2) system call directly. This ensures the input is treated strictly as a literal argument rather than a command to be parsed, effectively neutralizing RCE attempts.

e.GET("/lookup", func(c echo.Context) error {
	hostname := c.QueryParam("host")
	// SECURE: Arguments are passed as separate strings, bypassing shell parsing
	cmd := exec.Command("nslookup", hostname)
	out, err := cmd.CombinedOutput()
	if err != nil {
		return c.String(http.StatusInternalServerError, "Execution failed")
	}
	return c.String(http.StatusOK, string(out))
})