Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Reverted from v. 18

...

Code Block
bgColor#FFcccc
  
String programName = System.getProperty(""program.name"");
if (programName != null){ 
  // Runs user controlled program 
  Runtime runtime = Runtime.getRuntime();
  Process proc = runtime.exec(programName); 
}

...

Code Block
bgColor#FFcccc
  
// programName can be 'ProgramName1 || ProgramName2'  
Process proc = runtime.exec(""/bin/sh"" + programName);  // ""cmd.exe /C"" on Windows

Compliant Solution

...

Code Block
bgColor#ccccff
Process proc;
int filename = Integer.parseInt(System.getproperty(""program.name"")); // only allow integer choices
Runtime runtime = Runtime.getRuntime();

switch(filename) {
  case 1: 
    proc = runtime.exec(""hardcoded\program1""); 
    break; // Option 1
  case 2: 
    proc = runtime.exec(""hardcoded\program2""); 
    break; // Option 2
  default:
    System.out.println(""Invalid option!"");
    break; 
}

Compliant Solution

...

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

IDS03 MSC32- J

high

probable

medium

P12

L1

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other languages

This rule appears in the C Secure Coding Standard as ENV03-C. Sanitize the environment when invoking external programs.

...

Wiki Markup
\[[OWASP 05|AA. Java References#OWASP 05]\] [Reviewing Code for OS Injection|http://www.owasp.org/index.php/Reviewing_Code_for_OS_Injection]
\[[Chess 07|AA. Java References#Chess 07]\] Chapter 5: Handling Input, ""Command Injection""
\[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 78|http://cwe.mitre.org/data/definitions/78.html] ""Failure to Preserve OS Command Structure (aka 'OS Command Injection')""

...

MSC31-J. Never hardcode sensitive information            49. Miscellaneous (MSC)            IDS04-J. Prevent against SQL Injection