Applications that execute operating system commands or execute commands that interact with the underlying system should neutralize any externally-provided values used in those commands. Failure to do so could allow an attacker to include input that executes unintended commands, or exposes sensitive data.
This rule logs issues for dynamically-built commands, and when parameter values are used to influence how a command is run. it's then up to the auditor to figure out if the command execution is secure or not.
public void listContent(String input) { Runtime rt = Runtime.getRuntime(); rt.exec("ls " + input); // Noncompliant; input could easily contain extra commands ... } public void execute(String command, String argument) { ProcessBuilder pb = new ProcessBuilder(command, argument); // Noncompliant ... } public void doTheThing(String path) { ProcessBuilder pb = new ProcessBuilder("ls"); // command hard coded. So far, so good pb.redirectOutput(path); // Noncompliant }