Page History

...

Consequently, if an environment variable contains information that is available by other means, including system properties, that environment variable must not be used.

Noncompliant Code Example

This noncompliant code example tries to get the user name, using an environment variable.

...

This program runs the program /usr/bin/printenv which prints out all environment variables and their values. It takes a single argument string, and sets the USER environment variable to that string. The subsequent output of the printenv program will indicate that the USER environment variable is indeed set to the string requested.

Compliant Solution

This compliant solution obtains the user name using the user.name system property. This property always contains the correct user name, even if the USER environment variable has been set to an incorrect value, or does not exist.

String username = System.getProperty("user.name");

Risk Assessment

A program that depends on environment variables may be fed misinformation by an attacker.

Bibliography

...