Argument Injection Prevention (Downstream Input Delimiter Sanitization)
Description
Prevents injection of unintended arguments, options, or directives into downstream CLI tools, external processes, and structured input files by sanitizing delimiter characters (newlines, option-prefix dashes, null bytes) in user-controlled input before subprocess invocation. Enforces the -- end-of-options separator when passing variable input as positional arguments, uses array-based argument construction to preserve argument boundaries, and validates that input destined for downstream tool input files does not contain format-breaking delimiters. Distinct from command injection prevention (CME-1307) which addresses shell metacharacter injection: this control addresses injection into the argument parser or input file format of the downstream tool itself, even when no shell is involved.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Delimiter characters in user input are neutralized before reaching the downstream tool's argument parser or input file format; attacker cannot inject option flags, break record boundaries, or introduce additional URIs |
| Integrity (I) | H → L | Cannot inject --option=value arguments to control downstream tool behavior such as file write destinations, execution targets, or configuration overrides |
| Scope (S) | C → U | Downstream tool cannot be manipulated via injected arguments to affect resources outside its intended operational scope |
CWE Relationships
Verification
Verify that subprocess invocations use -- end-of-options before variable arguments and validate input for delimiter characters
# Expected: End-of-options separator present before variable positional arguments in subprocess calls
# Expected: Subprocess invocations use array-based arguments with input validation for delimiter characters