C# – Moving from Desktop Development to Web Development

This explanation is based on a commented Ruby script from a friend of mine. If you want to improve the script, feel free to update it at the link.

First, note that when Ruby calls out to a shell, it typically calls /bin/sh, not Bash. Some Bash syntax is not supported by /bin/sh on all systems.

Here are ways to execute a shell script:

cmd = "echo 'hi'" # Sample string that can be used

1. Kernel#` , commonly called backticks – `cmd`

   This is like many other languages, including Bash, PHP, and Perl.

   Returns the result (i.e. standard output) of the shell command.

   Docs: http://ruby-doc.org/core/Kernel.html#method-i-60

   value = `echo 'hi'`
   value = `#{cmd}`
   

2. Built-in syntax, %x( cmd )

   Following the x character is a delimiter, which can be any character. If the delimiter is one of the characters (, [, {, or <, the literal consists of the characters up to the matching closing delimiter, taking account of nested delimiter pairs. For all other delimiters, the literal comprises the characters up to the next occurrence of the delimiter character. String interpolation #{ ... } is allowed.

   Returns the result (i.e. standard output) of the shell command, just like the backticks.

   Docs: https://docs.ruby-lang.org/en/master/syntax/literals_rdoc.html#label-Percent+Strings

   value = %x( echo 'hi' )
   value = %x[ #{cmd} ]
   

3. Kernel#system

   Executes the given command in a subshell.

   Returns true if the command was found and run successfully, false otherwise.

   Docs: http://ruby-doc.org/core/Kernel.html#method-i-system

   wasGood = system( "echo 'hi'" )
   wasGood = system( cmd )
   

4. Kernel#exec

   Replaces the current process by running the given external command.

   Returns none, the current process is replaced and never continues.

   Docs: http://ruby-doc.org/core/Kernel.html#method-i-exec

   exec( "echo 'hi'" )
   exec( cmd ) # Note: this will never be reached because of the line above
   

Here's some extra advice: $?, which is the same as $CHILD_STATUS, accesses the status of the last system executed command if you use the backticks, system() or %x{}. You can then access the exitstatus and pid properties:

$?.exitstatus

For more reading see:

• http://www.elctech.com/blog/i-m-in-ur-commandline-executin-ma-commands
• http://blog.jayfields.com/2006/06/ruby-kernel-system-exec-and-x.html
• http://tech.natemurray.com/2007/03/ruby-shell-commands.html

I think you are attacking it from the wrong angle by trying to encode all posted data.

Note that a "<" could also come from other outside sources, like a database field, a configuration, a file, a feed and so on.

Furthermore, "<" is not inherently dangerous. It's only dangerous in a specific context: when writing strings that haven't been encoded to HTML output (because of XSS).

In other contexts different sub-strings are dangerous, for example, if you write an user-provided URL into a link, the sub-string "javascript:" may be dangerous. The single quote character on the other hand is dangerous when interpolating strings in SQL queries, but perfectly safe if it is a part of a name submitted from a form or read from a database field.

The bottom line is: you can't filter random input for dangerous characters, because any character may be dangerous under the right circumstances. You should encode at the point where some specific characters may become dangerous because they cross into a different sub-language where they have special meaning. When you write a string to HTML, you should encode characters that have special meaning in HTML, using Server.HtmlEncode. If you pass a string to a dynamic SQL statement, you should encode different characters (or better, let the framework do it for you by using prepared statements or the like)..

When you are sure you HTML-encode everywhere you pass strings to HTML, then set ValidateRequest="false" in the <%@ Page ... %> directive in your .aspx file(s).

In .NET 4 you may need to do a little more. Sometimes it's necessary to also add <httpRuntime requestValidationMode="2.0" /> to web.config (reference).