Skip to content

add CommandInjection.java #164

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
chuckaude wants to merge 1 commit into from
Closed

add CommandInjection.java #164

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions src/main/java/CommandInjection.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
// https://documentation.blackduck.com/bundle/coverity-docs/page/checker-ref/checkers/NO/os_cmd_injection.html

import java.io.*;
import javax.servlet.http.HttpServletRequest;

public class CommandInjection {
public static Process runCmd(HttpServletRequest request) throws IOException {
String command = request.getParameter("command");
ProcessBuilder builder = new ProcessBuilder("sh", command);

@github-actions github-actions Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto-generated PR comment (Coverity)

Coverity Issue - OS Command Injection

Priority: High
Vulnerability: CWE-78
CID: 10014

View in Coverity Connect

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

How to fix

Ensure that external-influenced data cannot modify the intent of the OS command. Sanitize the data before using it inside a sensitive function call. If possible, use a safer library or API call instead.

@github-actions github-actions Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto-generated PR comment (Coverity)

Coverity Issue - OS Command Injection

Priority: High
Vulnerability: CWE-78
CID: 10014

View in Coverity Connect

Calling "ProcessBuilder". Passing the tainted value "{"sh", command}" to the process-invoking API may allow an attacker to modify the intention of the command.

A user can change the intent of an operating system command. This change may result in the disclosure, destruction, or modification of sensitive data or operating system resources.

How to fix

Ensure the tainted data cannot modify the intent of the OS command. If possible, use a safer library or API call instead.

Process process = builder.start();
return(process);
}
}
Loading