OS command injection (ARCH4102)
Esta página aún no está disponible en tu idioma.
Key java.security.os-command-injection · Severity error · Category security · CWE CWE-78
Building a command string from untrusted input or running it through a shell lets attackers execute arbitrary commands with metacharacters like ; or |.
Incorrect
Section titled “Incorrect”String host = request.getParameter("host");Runtime.getRuntime().exec("ping -c 1 " + host);Correct
Section titled “Correct”String host = request.getParameter("host");new ProcessBuilder("ping", "-c", "1", host).start();Pass the command and its arguments as a separate array to ProcessBuilder; avoid shell interpretation and string concatenation.