Repository navigation
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| public class CommandInjection { | ||
| public static Process runCmd(HttpServletRequest request) throws IOException { | ||
| String command = request.getParameter("command"); | ||
| ProcessBuilder builder = new ProcessBuilder("sh", command); |
There was a problem hiding this comment.
Auto-generated PR comment (Coverity)
Coverity Issue - OS Command Injection
Priority: High
Vulnerability: CWE-78
CID: 10014
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
How to fix
Ensure that external-influenced data cannot modify the intent of the OS command. Sanitize the data before using it inside a sensitive function call. If possible, use a safer library or API call instead.
| public class CommandInjection { | ||
| public static Process runCmd(HttpServletRequest request) throws IOException { | ||
| String command = request.getParameter("command"); | ||
| ProcessBuilder builder = new ProcessBuilder("sh", command); |
There was a problem hiding this comment.
Auto-generated PR comment (Coverity)
Coverity Issue - OS Command Injection
Priority: High
Vulnerability: CWE-78
CID: 10014
Calling "ProcessBuilder". Passing the tainted value "{"sh", command}" to the process-invoking API may allow an attacker to modify the intention of the command.
A user can change the intent of an operating system command. This change may result in the disclosure, destruction, or modification of sensitive data or operating system resources.
How to fix
Ensure the tainted data cannot modify the intent of the OS command. If possible, use a safer library or API call instead.
No description provided.