Why this matters
Environment variable injection can allow attackers to manipulate system behavior, affecting sensitive paths like `PATH` or `LD_PRELOAD`. Always sanitize external input before using it.
Ensure that external user input is properly sanitized before being used to define environment variables.
Environment variable injection can allow attackers to manipulate system behavior, affecting sensitive paths like `PATH` or `LD_PRELOAD`. Always sanitize external input before using it.
Side-by-side examples engineers can pattern-match during review.
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
Runtime r = Runtime.getRuntime();
String userInput = request.getParameter("example");
if (userInput != null) {
String[] envs = {userInput};
r.exec("/path/to/example", userInput);
} else{
r.exec("/path/to/example");
}
}protected void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
Runtime r = Runtime.getRuntime();
String userInput = request.getParameter("example");
if (userInput != null && userInput.matches("^[a-zA-Z0-9]*$")) {
String[] envs = {"ENV_VAR=%s".format(userInput)};
r.exec("/path/to/example", envs);
} else {
r.exec("/path/to/example");
}
}protected void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
Runtime r = Runtime.getRuntime();
String userInput = request.getParameter("example");
if (userInput != null) {
String[] envs = {userInput};
r.exec("/path/to/example", userInput);
} else{
r.exec("/path/to/example");
}
}protected void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
Runtime r = Runtime.getRuntime();
String userInput = request.getParameter("example");
if (userInput != null && userInput.matches("^[a-zA-Z0-9]*$")) {
String[] envs = {"ENV_VAR=%s".format(userInput)};
r.exec("/path/to/example", envs);
} else {
r.exec("/path/to/example");
}
}From the same buckets as this rule.