...
- command processor via a call to
system()or similar function.
This is also addressed in ENV03-A. Sanitize the environment when running with elevated privilegesinvoking external programs. - external programs
- relational databases
- third-party COTS components (e.g., an enterprise resource planning subsystem)
...
For more info on the system() call, see ENV03-A. Sanitize the environment when running with elevated privilegesinvoking external programs and ENV04-A. Do not call system() if you do not need a command processor.
...