JAVA.IO.INJ.COMMAND : Command Injection (Java)

Summary

Tainted data flows into a field annotated as @CommandTrusted, or into a command execution routine.

Checks for this class use the CodeSonar Java taint analysis. See Taint Tracking for CodeSonar Java Warning Classes for more information on this analysis, including lists of the methods that CodeSonar automatically recognizes as relevant and information about specifying additional methods that CodeSonar should recognize as taint sources, sinks, or sanitizers.

Use configuration parameter JAVA_ANALYSIS_ADVANCED_INJECTION to specify the level of checking to perform for this and other taint-related warning classes:

• For basic checking, set JAVA_ANALYSIS_ADVANCED_INJECTION=No in your project configuration file.
• For advanced checking, set JAVA_ANALYSIS_ADVANCED_INJECTION=Yes.

Properties

WARNING_FILTER += discard class="Command Injection (Java)"

Example

import java.io.IOException;

public class CommandInjection {

    // The command name comes from the environment (untrusted) and is run
    // directly, so an attacker who controls it runs arbitrary programs.
    Process runBuggy() throws IOException {
        String command = System.getenv("USER_CMD");
        return new ProcessBuilder(command).start();   // 'Command Injection (Java)' warning issued here
    }

    // The fixed variant runs a fixed command with no external input.
    Process runFixed() throws IOException {
        return new ProcessBuilder("/bin/ls", "-l").start();   // ok: no external input
    }
}

To reproduce this example, analyze it with the following configuration:

JAVA_ANALYSIS_ENTRY_POINTS_MODE = ALL_METHODS
# Injection detection is a taint analysis: it needs field-sensitive tracking,
# merged creation points, and the advanced-injection checks, and the value
# read from the environment must be treated as untrusted.
JAVA_ANALYSIS_FIELD_SENSITIVE = Yes
JAVA_ANALYSIS_MERGE_CREATION_POINTS = Yes
JAVA_ANALYSIS_ADVANCED_INJECTION = Yes
JAVA_ANALYSIS_TRUST_ENVIRONMENT = No

Resolution

Verify that a security error actually corresponds to unconstrained information flow from source locations into sink locations. If this is the case, add a sanitizing algorithm to clean data before it flows into sinks, or use safe statements to propagate data inside the program.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.

• JAVA_ANALYSIS_ADVANCED_INJECTION
• JAVA_ANALYSIS_FIELD_SENSITIVE
• JAVA_ANALYSIS_MERGE_CREATION_POINTS
• JAVA_ANALYSIS_TRUST_DATABASE
• JAVA_ANALYSIS_TRUST_DEVICE
• JAVA_ANALYSIS_TRUST_ENVIRONMENT
• JAVA_ANALYSIS_TRUST_EXTERNAL_STREAMS
• JAVA_ANALYSIS_TRUST_USER_INPUT
• REPORT_SIMILAR_WARNINGS
• WARNING_FILTER