Page History

Both environment variables and system properties provide user-defined mappings between keys and their corresponding values, and can be used to communicate those values from the environment to a process. According to the Java API \[[API 2006|AA. Bibliography#API 06]\] {{java.lang.System}} class documentation,

Environment variables have a more global effect because they are visible to all descendants of the process which defines them, not just the immediate Java subprocess. They can have subtly different semantics, such as case insensitivity, on different operating systems. For these reasons, environment variables are more likely to have unintended side effects. It is best to use system properties where possible. Environment variables should be used when a global effect is desired, or when an external system interface requires an environment variable (such as PATH).

...

In fact, relying on environment variables is more than a simple portability issue. An attacker can essentially control all environment variables that enter a program , using a mechanism such as the java.lang.ProcessBuilder class.

...

This program runs the program /usr/bin/printenv, which prints out all environment variables and their values. It takes a single argument string , and sets the USER environment variable to that string. The subsequent output of the printenv program will indicate that the USER environment variable is indeed set to the string requested.

...

This compliant solution obtains the user name using the user.name system property. This property always contains the correct user name, even when the USER environment variable has been set to an incorrect value , or is missing.

String username = System.getProperty("user.name");

...

...