3

I want to open a text file programmatically using C#. I have used :

System.Diagnostics.Process.Start(test.txt);

but this code is causing OS command injection problem when scanning for threats.

Is there any way that i can open a text file programmatically?? or way to bypass that OS command injection?

Thank you

2 Answers 2

1

You should call a program, say notepad:

Process.Start("notepad.exe", fileName);

the argument is the file name:

 Process.Start("notepad.exe", "Test.txt");

See the problem with your code in the comments of this post: Open a file with Notepad in C#

6
  • I am trying this solution now and will sumit a scan. Thanks for the immediate reply. Jan 14, 2014 at 8:59
  • This doesnot solve the issue, it is still catching the process.start as OS COMMAND INJECTION. Jan 14, 2014 at 11:59
  • Are you actually putting in a string such as "this_is_hard_coded.txt" or just passing an argument without any validation? see : owasp.org/index.php/OS_Injection Jan 14, 2014 at 12:40
  • First time : var test = "test.txt" process.start(test) I had even validated the variable to check if there it contain 'txt' Jan 14, 2014 at 12:59
  • yes , but have you tried passing notepad.exe and test.txt both as hard coded strings (not from args) - if this doesn't work for you I have to give up :) Jan 15, 2014 at 7:50
0

Try:

 System.Diagnostics.Process process = new System.Diagnostics.Process();
 System.Diagnostics.ProcessStartInfo startInfo = new 
 System.Diagnostics.ProcessStartInfo();
 startInfo.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden;
 startInfo.FileName = "cmd.exe";
 string _path = "c:/filepath";
 startInfo.Arguments = string.Format("/C start {0}", _path);
 process.StartInfo = startInfo;
 process.Start();

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.