Page History

...

Every Java application has a single instance of class Runtime that allows the application to interface with the environment in which the application is running. The current runtime can be obtained from the Runtime.getRuntime() method. The semantics of Runtime.exec() are poorly defined, so it's best not to rely on its behavior any more than necessary. It will invoke , but typically it invokes the command directly without a shell. If you want a shell, you can use /bin/sh -c on POSIX or cmd.exe on Windows. The variants of exec() that take the command line as a single string split it using a StringTokenizer. On Windows, these tokens are concatenated back into a single argument string before being executed.

...

This is a specific instance of the rule IDS00-J. Sanitize untrusted data passed across a trust boundary. Any string data that originates from outside the program's trust boundary must be sanitized before being executed as a command on the current platform.

...

  
class DirList {
  public static void main(String[] args) throws Exception {
    String dir = System.getProperty("dir");
    Runtime rt = Runtime.getRuntime();
    Process proc = rt.exec("cmd.exe /C dir " + dir);
    int result = proc.waitFor();
    if (result != 0) {
      System.out.println("process error: " + result);
    }
    InputStream in = (result == 0) ? proc.getInputStream() :
                                     proc.getErrorStream();
    int c;
    while ((c = in.read()) != -1) {
      System.out.print((char) c);
    }
  }
}

...

  
class DirList {
  public static void main(String[] args) throws Exception {
    String dir = System.getProperty("dir");
    Runtime rt = Runtime.getRuntime();
    Process proc = rt.exec(new String[] {"sh", "-c", "ls " + dir});
    int result = proc.waitFor();
    if (result != 0) {
      System.out.println("process error: " + result);
    }
    InputStream in = (result == 0) ? proc.getInputStream() :
                                     proc.getErrorStream();
    int c;
    while ((c = in.read()) != -1) {
      System.out.print((char) c);
    }
  }
}

...

This compliant solution sanitizes the untrusted user input by permitting only allowing a small number group of whitelisted characters to in the argument that will be passed as part of the argument to Runtime.exec(); all other characters are excluded.

// ...
if (!Pattern.matches("[0-9A-Za-z@.]+", dir)) {
  // Handle error
}
// ...

Although this is a compliant solution, the this sanitization method approach rejects valid directories. Also, because the command interpreter invoked is system dependent, it is difficult to establish that this solution will not allow prevents command injection injections on every possible platform in on which a Java program might run.

...

This compliant solution prevents command injection by passing only passing trusted strings to Runtime.exec(). While the user has control over which string is used, the user cannot provide string data directly to Runtime.exec().

...

This solution can quickly become unmanageable if you have many available directories. A more scalable solution is to read all the available permitted directories from a properties file into a java.util.Properties object. Alternately, the switch statement can operate on an enumerated type.

Compliant Solution (Avoid Runtime.exec())

...

...

Bibliography

...