SV.EXEC.ENV

This error is detected when user input is used, unchecked, for all or part of an environment variable used by the application.

Vulnerability and risk

In general, process creation or execution of external commands within an application is a security concern. There is a serious vulnerability if user input is used in any part of the command string used for execution. Attackers can change environment variables, leading to denial-of-service (DoS), data corruption, data security violations and other risks.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Prevent process or command injection attacks from user input by validating any and all input from outside the application (user input, file input, system parameters, etc.). Validation should include length and content. Typically only alphanumeric characters are needed (i.e., A-Za-z, 0-9). Any other accepted characters should be escaped. Perform validation at each source of data, such as when each parameter is read from the HTTP request, or user interface such as an application or the console.

Example 1

Copy

11
12
13
14
15
16
17
     public void dataQuery(ServletRequest req) throws IOException {
         String var = "USER_HOME=" + req.getParameter("username");
         String[] env = new String[]{var};
         Process proc = Runtime.getRuntime().exec("processRequest", env);
         // parse results of command
         // ...
     }

SV.EXEC.ENV is reported for line 14: 'var' contains data coming from an HTTP request parameter and might be tainted (line 12). This value is stored in string array 'env' on line 13 which is used as a parameter for process execution on line 14. An attacker may change environment variables to modify application behavior.

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Os Command Injections Training Video - Test your skills with a training example

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.