Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Java Guidance: ExecTainted.ql (experimental version) #10665

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
smowton merged 4 commits into from
Oct 5, 2022
Merged

Java Guidance: ExecTainted.ql (experimental version) #10665

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
bff2633
java guidance: experimental version of exectainted
Oct 3, 2022
35948b0
Merge branch 'main' into dilan-java/guidance-exectainted
dilanbhalla Oct 3, 2022
536276a
Merge branch 'main' of https://github.com/github/codeql into dilan-ja…
Oct 3, 2022
888d756
Merge branch 'dilan-java/guidance-exectainted' of https://github.com/…
Oct 3, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions java/ql/src/experimental/Security/CWE/CWE-078/ExecTainted.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
class Test {
public static void main(String[] args) {
String script = System.getenv("SCRIPTNAME");
if (script != null) {
// BAD: The script to be executed is controlled by the user.
Runtime.getRuntime().exec(script);
}
}
}
47 changes: 47 additions & 0 deletions java/ql/src/experimental/Security/CWE/CWE-078/ExecTainted.qhelp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>
<overview>
<p>Code that passes user input directly to <code>Runtime.exec</code>, or
some other library routine that executes a command, allows the
user to execute malicious code.</p>

</overview>
<recommendation>

<p>If possible, use hard-coded string literals to specify the command to run
or library to load. Instead of passing the user input directly to the
process or library function, examine the user input and then choose
among hard-coded string literals.</p>

<p>If the applicable libraries or commands cannot be determined at
compile time, then add code to verify that the user input string is
safe before using it.</p>

</recommendation>
<example>

<p>The following example shows code that takes a shell script that can be changed
maliciously by a user, and passes it straight to <code>Runtime.exec</code>
without examining it first.</p>

<sample src="ExecTainted.java" />

</example>
<references>

<li>
OWASP:
<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
</li>
<li>SEI CERT Oracle Coding Standard for Java:
<a href="https://wiki.sei.cmu.edu/confluence/display/java/IDS07-J.+Sanitize+untrusted+data+passed+to+the+Runtime.exec()+method">IDS07-J. Sanitize untrusted data passed to the Runtime.exec() method</a>.</li>



<!-- LocalWords: CWE untrusted unsanitized Runtime
-->

</references>
</qhelp>