Invalid Exec Command
ID |
go.invalid_exec_command |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Go |
Tags |
reliability, suspicious |
Description
Reports a call to exec.Command whose first argument is a string literal that contains a
space — that is, a whole command line such as "ls -la" passed where the program name is
expected. exec.Command does not run the argument through a shell: the first argument is
the executable name and each subsequent argument is a separate parameter. A command line
collapsed into one string is looked up verbatim as an executable named ls -la, which does
not exist, so the call fails at runtime.
Rationale
This is a frequent mistake for developers used to shells, where ls -la is a single string.
In Go the arguments must be split: exec.Command("ls", "-la"). The single-string form
compiles cleanly and only fails when executed, so it survives review and slips into
production. Flagging the literal at build time turns a runtime failure into an immediate fix.
exec.Command("ls -la") // FLAW — looks up an executable literally named "ls -la"
exec.Command("git commit -m x") // FLAW — the flags are part of the program name
exec.Command("ls", "-la") // OK — program and arguments are separate
exec.Command("git", "status") // OKRemediation
Split the command line into the program name and its arguments:
exec.Command("ls", "-la"). If the arguments are dynamic, build a slice and pass it with the
spread operator, or use exec.CommandContext the same way.