Command Injection

[carterleehaney]

The way you handle user input in lines 178-195 of Dashboard.xaml.cs is vulnerable to command injection.

switch (ruleType)
                {
                    case "IP":
                        psScript = $"New-NetFirewallRule -DisplayName '{ruleName}' -Direction Outbound -RemoteAddress '{ruleValue}' -Action {action} -Enabled True -Profile Any";
                        break;

                    case "Port":
                        psScript = $"New-NetFirewallRule -DisplayName '{ruleName}' -Direction Outbound -Protocol TCP -RemotePort {ruleValue} -Action {action} -Enabled True -Profile Any";
                        break;

                    case "Application":
                        psScript = $"New-NetFirewallRule -DisplayName '{ruleName}' -Direction Outbound -Program '{ruleValue}' -Action {action} -Enabled True -Profile Any";
                        break;

                    default:
                        MessageBox.Show("Unsupported rule type.");
                        return;
                }