OS command injection (ARCH4102)

Key java.security.os-command-injection · Severity error · Category security · CWE CWE-78

Building a command string from untrusted input or running it through a shell lets attackers execute arbitrary commands with metacharacters like ; or |.

Incorrect

String host = request.getParameter("host");
Runtime.getRuntime().exec("ping -c 1 " + host);

Correct

String host = request.getParameter("host");
new ProcessBuilder("ping", "-c", "1", host).start();

Fix

Pass the command and its arguments as a separate array to ProcessBuilder; avoid shell interpretation and string concatenation.