Securing Large Applications Against Command Injections

The ability to produce more secure software or to improve the security of existing software is a growing concern and a real challenge for the field of software engineering. Among the various existing types of software vulnerabilities, command injections are particularly common. It is a difficult problem to address, having seemingly endless variations. We present here a unified, formal definition of command injections that, is not based on a particular technology and captures not only the existing variations but also the future instances of the problem. We then propose a simple, yet effective strategy to deal with the problem in existing large applications, focusing on the cost effectiveness of the method. We also report on successful experiments applying our solution to large commercial applications.