java - java/lang/Runtime.exec([Ljava/lang/String;)Ljava/lang/Process; 的用法可能容易受到命令注入(inject)的攻击

Question

如何在 Sonar 角度修复以下代码。它抛出以下错误

This usage of java/lang/Runtime.exec([Ljava/lang/String;)Ljava/lang/Process; can be vulnerable to Command Injection

下面是代码

String commandArr[] = new String[] {"curl", "-v", "-X", "put", "--user", drUserName + ":" + drPwd, "-H", "Content-Type:text/plain",
            "-H","X-ATT-DR-META:"+metaData, "--data", response.toString(), "--post301", "--location-trusted", feedFile};

    String command = Arrays.toString(commandArr);
    int returnCode = -1;
    try {
        returnCode = obj.executeCommand(commandArr);
    } catch{...}

以下代码有问题

private int executeCommand(String[] command) {  
    int returnCode = -1;
    final String Msg = "HTTP/1.1 204 No Content";
    boolean isMsg= false; Process proc;
    try {
        proc = Runtime.getRuntime().exec(command); //sonar issue
        returnCode = proc.waitFor();
        BufferedReader reader = new BufferedReader(new InputStreamReader(proc.getErrorStream()));
        String line = "";
        while ((line = reader.readLine()) != null) {
            if (!isMsg) {
                if (line.contains(Msg)) {
                    isMsg= true;
                }
            }
        }
    } catch (Exception e) {...} 
    .....
    .....
    return returnCode;
}

有人可以帮忙吗？

Answer 1

根据owasp.org page on Java command injection ，使用 Runtime.exec 打开您的应用程序以进行命令注入(inject):

Command injection vulnerabilities allow an attacker to inject arbitrary system commands into an application. The commands execute at the same privilege level as the Java application and provides an attacker with functionality similar to a system shell.

根据 OWASP，解决 Runtime.exec 命令注入(inject)的最佳实践是:

Developers should avoid invoking the shell using Runtime.exec in order to call operating system specific commands and should use Java APIs instead.

因此，在您的情况下，不要使用 Runtime.exec 执行 cURL 来执行 PUT HTTP 操作，您可能需要考虑使用 Java 库来执行相同的操作。例如，问题REST clients for Java的答案中的一些内容应该可以解决问题。