Use ProcessBuilder and full path to explorer command instead of Runtime and short command from PATH in FileUtil.openFilePathInExplorer() - Githubissues

FelixBaensch / MORTAR

MOlecule fRagmenTAtion fRamework

MIT License

18 stars 3 forks source link

Use ProcessBuilder and full path to explorer command instead of Runtime and short command from PATH in FileUtil.openFilePathInExplorer() #120

Open JonasSchaub opened 1 month ago

JonasSchaub commented 1 month ago

SonarCloud reports a security risk here because the full path to explorer.exe is not specified but the explorer command taken from PATH (https://sonarcloud.io/organizations/felixbaensch/rules?open=java%3AS4036&rule_key=java%3AS4036). See e.g. this for a possible compliant solution: https://stackoverflow.com/a/76085694 But on the other hand, if we cannot trust the explorer command, something is seriously wrong... Also needs to be adjusted for Linux and Mac.