这可能是java/lang/Runtime的用法。exec（[Ljava/lang/String；）Ljava/lang/Process；可能容易受到命令注入的攻击

Question

如何在sonar透视图中修复以下代码。它抛出以下错误

This usage of java/lang/Runtime.exec([Ljava/lang/String;)Ljava/lang/Process; can be vulnerable to Command Injection

下面是代码

String commandArr[] = new String[] {"curl", "-v", "-X", "put", "--user", drUserName + ":" + drPwd, "-H", "Content-Type:text/plain",
            "-H","X-ATT-DR-META:"+metaData, "--data", response.toString(), "--post301", "--location-trusted", feedFile};

    String command = Arrays.toString(commandArr);
    int returnCode = -1;
    try {
        returnCode = obj.executeCommand(commandArr);
    } catch{...}

在以下代码中有问题

private int executeCommand(String[] command) {  
    int returnCode = -1;
    final String Msg = "HTTP/1.1 204 No Content";
    boolean isMsg= false; Process proc;
    try {
        proc = Runtime.getRuntime().exec(command); //sonar issue
        returnCode = proc.waitFor();
        BufferedReader reader = new BufferedReader(new InputStreamReader(proc.getErrorStream()));
        String line = "";
        while ((line = reader.readLine()) != null) {
            if (!isMsg) {
                if (line.contains(Msg)) {
                    isMsg= true;
                }
            }
        }
    } catch (Exception e) {...} 
    .....
    .....
    return returnCode;
}

有人能帮忙吗

Answer 1

根据owasp.org page on Java command injection，使用运行时。exec打开应用程序以进行命令注入：

Command injection vulnerabilities allow an attacker to inject arbitrary system commands into an application. The commands execute at the same privilege level as the Java application and provides an attacker with functionality similar to a system shell.

根据OWASP解决运行时问题的最佳实践。exec命令注入是指：

Developers should avoid invoking the shell using Runtime.exec in order to call operating system specific commands and should use Java APIs instead.

因此，在您的情况下，不要使用运行时。exec执行cURL以执行PUT HTTP操作， 您可能需要考虑使用java库执行相同的操作。例如，问题REST clients for Java的答案中的某些内容应该会起作用