Page History

...

Code Block

bgColor	#ccccff

// ...
String dir = null;

int number = Integer.parseInt(System.getpropertygetProperty("dir")); // only allow integer choices
switch (number) {
  case 1: 
    dir = "data1";
    break; // Option 1
  case 2: 
    dir = "data2";
    break; // Option 2
  default: // invalid
    break; 
}
if (dir == null) {
  // handle error
}

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="9c6ade6b7ae3f5ee-10e20f4e-4d314e4b-953ca261-08e030e451a33efc22bbc3c9"><ac:plain-text-body><![CDATA[	[CVE-2010-0886]	[Sun Java Web Start Plugin Command Line Argument Injection	http://www.securitytube.net/video/1465]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="470b6f09a4859e26-9b6a5444-48174f06-947ea66e-b3c0ff65146d34e03542af17"><ac:plain-text-body><![CDATA[	[CVE-2010-1826]	[Command injection in updateSharingD's handling of Mach RPC messages	http://securitytracker.com/id/1024617]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="51b1dda932c5e5a4-a97e77e9-4d414a57-8b23bdd2-654f29edaefa6fbb19b5f43e"><ac:plain-text-body><![CDATA[	[T-472]	[Mac OS X Java Command Injection Flaw in updateSharingD Lets Local Users Gain Elevated Privileges	http://www.doecirc.energy.gov/bulletins/t-472.shtml]	]]></ac:plain-text-body></ac:structured-macro>

...

The CERT C Secure Coding Standard	ENV03-C. Sanitize the environment when invoking external programs
	ENV04-C. Do not call system() if you do not need a command processor
The CERT C++ Secure Coding Standard	ENV03-CPP. Sanitize the environment when invoking external programs
	ENV04-CPP. Do not call system() if you do not need a command processor
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="2bfa5fd89fe82d06-0a8a7e43-471d41a8-be8ba4f2-d23849125543895826c5970d"><ac:plain-text-body><![CDATA[	[ISO/IEC TR 24772:2010	http://www.aitcnet.org/isai/]	"Injection [RST]"	]]></ac:plain-text-body></ac:structured-macro>
MITRE CWE	CWE-78, "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0d8290bb3ce8a22b-4b0bfa69-4e3f47a0-8c918029-702960f1615a22e9f1b6e3fc"><ac:plain-text-body><![CDATA[	[[Chess 2007	AA. Bibliography#Chess 07]]	Chapter 5: Handling Input, "Command Injection"]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="937dc302dafbe0f6-97df358d-4cb543df-b69db4a3-b6cbdd0cb78be473b29bf9aa"><ac:plain-text-body><![CDATA[	[[OWASP 2005	AA. Bibliography#OWASP 05]]	[Reviewing Code for OS Injection	http://www.owasp.org/index.php/Reviewing_Code_for_OS_Injection]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e1006ecb21cce984-3d651541-410b4095-9903b232-6dbcb4c34067116c6525630c"><ac:plain-text-body><![CDATA[	[[Permissions 2008	AA. Bibliography#Permissions 08]]	[Permissions in the Java™ SE 6 Development Kit (JDK)	http://java.sun.com/javase/6/docs/technotes/guides/security/permissions.html], Sun Microsystems, Inc. (2008)	]]></ac:plain-text-body></ac:structured-macro>

...

Space shortcuts

Page tree

Versions Compared

Old Version 116

New Version 117

Key