Blazor WASM执行Shell命令报错：Process类不支持当前平台

错误原因说明 #

Blazor WASM运行在浏览器的JavaScript沙箱环境中，System.Diagnostics.Process是.NET用于本地进程管理的API，浏览器环境受沙箱限制无法直接访问操作系统资源，因此会抛出PlatformNotSupportedException。要执行系统命令，必须通过后端服务中转实现。

解决方案：后端API中转执行 #

通过ASP.NET Core后端API处理命令执行逻辑，前端Blazor页面通过HTTP请求调用接口获取结果，以下是具体实现步骤：

1. 后端创建命令执行API端点 #

在Hosted模式的Server项目（或独立ASP.NET Core项目）中添加API控制器：

[ApiController]
[Route("api/[controller]")]
public class CommandController : ControllerBase
{
    [HttpPost("execute")]
    public IActionResult ExecuteCommand([FromBody] CommandRequest request)
    {
        if (string.IsNullOrEmpty(request.Command))
        {
            return BadRequest("命令不能为空");
        }

        try
        {
            var escapedArgs = request.Command.Replace("\"", "\\\"");
            using var process = new Process()
            {
                StartInfo = new ProcessStartInfo
                {
                    FileName = "/bin/bash",
                    Arguments = $"-c \"{escapedArgs}\"",
                    RedirectStandardOutput = true,
                    RedirectStandardError = true,
                    UseShellExecute = false,
                    CreateNoWindow = true,
                }
            };

            process.Start();
            string output = process.StandardOutput.ReadToEnd();
            string error = process.StandardError.ReadToEnd();
            process.WaitForExit();

            var result = new CommandResponse
            {
                Output = output,
                Error = error,
                ExitCode = process.ExitCode,
                Timestamp = DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss")
            };

            return Ok(result);
        }
        catch (Exception ex)
        {
            return StatusCode(500, new CommandResponse
            {
                Error = ex.ToString(),
                Timestamp = DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss")
            });
        }
    }

    public class CommandRequest
    {
        public string Command { get; set; }
    }

    public class CommandResponse
    {
        public string Output { get; set; }
        public string Error { get; set; }
        public int ExitCode { get; set; }
        public string Timestamp { get; set; }
    }
}

2. 前端Blazor页面调用API #

修改原页面代码，通过HttpClient调用后端接口：

@page "/bash"
@inject HttpClient Http

<h3>Bash 命令执行</h3>

<input @bind="command" placeholder="输入bash命令" />
<button class="btn btn-primary" @onclick="RunCommand">执行</button>
<p>执行结果:<br />
    命令: "@command" | 时间: @timestamp<br />
    @if (!string.IsNullOrEmpty(output))
    {
        <div>
            <strong>标准输出:</strong><br />
            @output
        </div>
    }
    @if (!string.IsNullOrEmpty(error))
    {
        <div style="color: red;">
            <strong>错误输出:</strong><br />
            @error
        </div>
    }
</p>

@code {
    private string command { get; set; }
    private string timestamp { get; set; }
    private string output { get; set; }
    private string error { get; set; }

    private async Task RunCommand()
    {
        timestamp = DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss");
        output = string.Empty;
        error = string.Empty;

        try
        {
            var request = new { Command = command };
            var response = await Http.PostAsJsonAsync("api/command/execute", request);
            
            if (response.IsSuccessStatusCode)
            {
                var result = await response.Content.ReadFromJsonAsync<CommandResponse>();
                output = result.Output;
                error = result.Error;
                timestamp = result.Timestamp;
            }
            else
            {
                var errorResult = await response.Content.ReadFromJsonAsync<CommandResponse>();
                error = errorResult.Error ?? $"请求失败，状态码: {response.StatusCode}";
            }
        }
        catch (Exception ex)
        {
            error = ex.ToString();
        }
    }

    private class CommandResponse
    {
        public string Output { get; set; }
        public string Error { get; set; }
        public int ExitCode { get; set; }
        public string Timestamp { get; set; }
    }
}

关键注意事项 #

• 安全风险：直接执行用户输入的命令存在严重命令注入漏洞，生产环境必须严格限制可执行命令范围，或采用白名单机制。
• 跨域配置：若前后端分离部署，需在后端配置CORS策略允许前端域名访问。
• 资源清理：使用using语句确保Process对象被正确释放，避免资源泄漏。

内容的提问来源于stack exchange，提问作者Darkmatter5