A municipal filter strips semicolon characters from PDF-job inputs but still shells out to build the command. What is the correct conceptual judgment?
Select an answer to reveal the explanation.
Short Explanation
Banning one punctuation mark is like locking one window and leaving the rest open. Metacharacter blacklists crack under alternates and encoding. The real fix is not playing Whac-A-Mole — use safe APIs and tight allowlists.
Full Explanation
Denylisting individual shell separators does not eliminate command injection when the application still invokes a shell or concatenates untrusted strings. Robust remediation avoids OS shells, uses parameterized invocations, and allowlists expected values. Assessment reports should stress this design weakness without enumerating bypass payloads as the answer key. Platform myths and open-source trust do not make unsafe command construction safe.