Page History

...

This noncompliant code example provides the same functionality but uses the POSIX ls command. The only difference from the Windows version is that the argument is passed to proc Runtime.exec() method.

Code Block

bgColor	#FFcccc

  
class DirList {
  public static void main(String[] args) throws Exception {
    String dir = System.getProperty("dir");
    Runtime rt = Runtime.getRuntime();
    Process proc = rt.exec(new String[] {"sh", "-c", "ls " + dir});
    int result = proc.waitFor();
    if (result != 0) {
      System.out.println("process error: " + result);
    }
    InputStream in = (result == 0) ? proc.getInputStream() : proc.getErrorStream();
    int c;
    while ((c = in.read()) != -1) {
      System.out.print((char) c);
    }
  }
}

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="7a9dbdc8427e86b9-5f18bcf1-41084703-8be2bbed-cc59ebb57359e793d0d55ed6"><ac:plain-text-body><![CDATA[	[CVE-2010-0886]	[Sun Java Web Start Plugin Command Line Argument Injection	http://www.securitytube.net/video/1465]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="2910e961a76df66e-036bc72f-4ced46b4-b3e7aa22-083dc9d3659a45f1dbf8355e"><ac:plain-text-body><![CDATA[	[CVE-2010-1826]	[Command injection in updateSharingD's handling of Mach RPC messages	http://securitytracker.com/id/1024617]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="668b001e92f8342f-1dcd2bb3-4e634b42-8409add0-7f5b0884379c8a86ebb708d2"><ac:plain-text-body><![CDATA[	[T-472]	[Mac OS X Java Command Injection Flaw in updateSharingD Lets Local Users Gain Elevated Privileges	http://www.doecirc.energy.gov/bulletins/t-472.shtml]	]]></ac:plain-text-body></ac:structured-macro>

...

The CERT C Secure Coding Standard	ENV03-C. Sanitize the environment when invoking external programs
	ENV04-C. Do not call system() if you do not need a command processor
The CERT C++ Secure Coding Standard	ENV03-CPP. Sanitize the environment when invoking external programs
	ENV04-CPP. Do not call system() if you do not need a command processor
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0ae1b75dc113c0ec-301cd59a-4d014661-adee9b13-c7589533d0105d4874c45bef"><ac:plain-text-body><![CDATA[	[ISO/IEC TR 24772:2010	http://www.aitcnet.org/isai/]	"Injection [RST]"	]]></ac:plain-text-body></ac:structured-macro>
MITRE CWE	CWE-78, "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="2f894b413d63ac03-39e60e4f-4f864ca4-bfb8ae2a-932b9c1a2c8d52dba83203a5"><ac:plain-text-body><![CDATA[	[[Chess 2007	AA. Bibliography#Chess 07]]	Chapter 5: Handling Input, "Command Injection"]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="fcd09e70e370b118-5ecc2eeb-430745f0-98129b83-b9f76f99e5cfb0064f9cd825"><ac:plain-text-body><![CDATA[	[[OWASP 2005	AA. Bibliography#OWASP 05]]	[Reviewing Code for OS Injection	http://www.owasp.org/index.php/Reviewing_Code_for_OS_Injection]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="5724201d7cd76590-b320894c-4c5e46be-b6dab8dc-3c968127f5eb1d533e0780ea"><ac:plain-text-body><![CDATA[	[[Permissions 2008	AA. Bibliography#Permissions 08]]	[Permissions in the Java™ SE 6 Development Kit (JDK)	http://java.sun.com/javase/6/docs/technotes/guides/security/permissions.html], Sun Microsystems, Inc. (2008)	]]></ac:plain-text-body></ac:structured-macro>

...

Space shortcuts

Page tree

Versions Compared

Old Version 113

New Version 114

Key