MISRA C++:2023 Rule 21.2.3

The library function system from <cstdlib> shall not be used

Since R2024b

Description

Rule Definition

The library function system from <cstdlib> shall not be used ¹

Rationale

The system() function is platform-dependent, which can result in implementation-defined or undefined behavior. Errors with the system() function can cause security vulnerabilities.

Instead, use direct API calls if possible, or safer functions such as posix_spawn().

Polyspace Implementation

Polyspace^® reports a violation whenever the code takes the address of the system() function from <cstdlib> or <stdlib.h>, calls the system() function, or expands a macro with the name system.

Troubleshooting

If you expect a rule violation but Polyspace does not report it, see Diagnose Why Coding Standard Violations Do Not Appear as Expected.

Examples

Security Vulnerability Issues with the system() Function

#include <cstdlib>
#include <iostream>

int main() {
    std::string directory;
    std::cout << "Enter directory to list: ";
    std::getline(std::cin, directory);

    std::string command = "ls " + directory; 
    system(command.c_str());                    // Noncompliant

    return 0;
}

In this example, the function call system(command.c_str()) is noncompliant. If the user enters a string that includes shell commands, they could execute arbitrary commands. For example, a user input such as ; rm -rf ~ could remove all files and directories in the current user's home directory.

Check Information

Group: Language support library

Category: Required

Version History

Introduced in R2024b