Command Injection

Command Injection Attack

{
  "query": "?domain=google.com%3BEcho%20%22Hacked%22"
}

Command Injection Protection

• Escape control characters: </>/?/=/&&.
• Disable code execution during deserialization.
• 尽量不使用系统执行命令.
• 保证动态函数为受信任函数, 防止被攻击者替换.