search

julz0815 / test-action

0 stars 1 forks source link

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') [VID:78:com/veracode/verademo/controller/ToolsController.java:94] #813

Open github-actions[bot] opened 6 months ago

github-actions[bot] commented 6 months ago

https://github.com/julz0815/test-action/blob/37a01908151c347054c82f620f4aee87f09d0b4d/com/veracode/verademo/controller/ToolsController.java#L89-L99

Filename: com/veracode/verademo/controller/ToolsController.java

Line: 94

CWE: 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))

This call to java.lang.Runtime.exec() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to exec() contains tainted data from the variable cmd. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection. References: CWE OWASP

github-actions[bot] commented 6 months ago

Veracode issue link to PR: https://github.com/julz0815/test-action/pull/809

github-actions[bot] commented 6 months ago

Veracode issue link to PR: https://github.com/julz0815/test-action/pull/829

github-actions[bot] commented 6 months ago

Veracode issue link to PR: https://github.com/julz0815/test-action/pull/830

github-actions[bot] commented 6 months ago

Veracode issue link to PR: https://github.com/julz0815/test-action/pull/830

github-actions[bot] commented 6 months ago

Veracode issue link to PR: https://github.com/julz0815/test-action/pull/830