Page History

...

This is a specific instance of the rule IDS00-J. Sanitize untrusted data passed across a trust boundary. Any string data that originates from outside the program's trust boundary must be sanitized before being executed as a command on the current platform.

Noncompliant Code Example (Windows)

A weakness in a privileged program caused by relying on untrusted sources such as system properties or the environment (see rule IDS03-J. Validate all data passed in through environment variables and non-default properties) can result in the execution of a command or of a program that has privileges beyond those possessed by a typical user.

...

which first attempts to list a nonexistent dummy folder, and then prints bad to the console.

Noncompliant Code Example (POSIX)

This noncompliant code example provides the same functionality, but uses the POSIX ls command. The only difference from the Windows version is the argument passed to proc.

...

sh -c 'ls dummy & echo bad'

Compliant Solution (Sanitization)

This compliant solution sanitizes the untrusted user input by permitting only a handful of correct characters to appear.

...

Although this is a compliant solution, the sanitization method is weak because it will reject valid directories. Also, because the command interpreter invoked is system dependent, it is difficult to say that this solution will not allow command injection on every possible platform in which a Java program might run.

Compliant Solution (Restricted User Choice)

This compliant solution prevents command injection by only passing trusted strings to Runtime.exec(). While the user has control over which string gets used, the user cannot send strings directly to Runtime.exec().

...

This solution can quickly become unmanageable if you have many available directories. A more scalable solution is to read all the email addresses from a properties file into a java.util.Properties object. Alternately, the switch statement can operator on an enum.

Compliant Solution (Avoid Runtime.exec())

When the task performed by executing a system command can be accomplished by some other means, it is almost always advisable to do so. This compliant solution uses the File.list() method to provide directory listing, thereby preventing command injection.

import java.io.File;

class DirList {
  public static void main(String[] args) throws Exception {
    File dir = new File(System.getProperty("dir"));
    if (!dir.isDirectory()) {
      System.out.println("Not a directory");
    } else {
      for (String file : dir.list()) {
        System.out.println(file);
      }
    }
  }
}

Risk Assessment

Passing untrusted, unsanitized data to the Runtime.exec() method can result in command and argument injection attacks.

Related Guidelines

Examples of related vulnerabilities include:

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Bibliography

...