You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This call to java.lang.ProcessBuilder.start() contains a command injection flaw.
The argument to the function is constructed using untrusted input.
If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process.
The level of exposure depends on the effectiveness of input validation routines, if any.
start() was called on the pb object, which contains tainted data.
The tainted data originated from earlier calls to java.lang.Process.getErrorStream, and java.lang.Process.getInputStream.
Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.
Most APIs that execute system commands also have a ""safe"" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection.
References:
CWE (https://cwe.mitre.org/data/definitions/78.html)
OWASP (https://owasp.org/www-community/attacks/Command_Injection)
Describe your task(s)
No response
Related area
-> Standard Library
Related issue(s) (optional)
No response
Suggested label(s) (optional)
No response
Suggested assignee(s) (optional)
No response
The text was updated successfully, but these errors were encountered:
Description
Fix the following reported vulnerability :
Describe your task(s)
No response
Related area
-> Standard Library
Related issue(s) (optional)
No response
Suggested label(s) (optional)
No response
Suggested assignee(s) (optional)
No response
The text was updated successfully, but these errors were encountered: