Zennoxa Shield
Rules / Java
SHIELD-JAVA-002

OS Command Injection via Runtime.exec

criticalJavaCWE-78CVSS 9.8

What it detects

Runtime.getRuntime().exec called with a concatenated string permits command injection.

How to fix

Avoid shell invocation; pass a fixed command with an argument array and validate all inputs.

Vulnerable — Shield flags thisPingService.java
import java.io.IOException;

public class PingService {
    public void ping(String host) throws IOException {
        Runtime.getRuntime().exec("ping -c 1 " + host);
    }
}
Fixed — scans cleanPingService.java
import java.io.IOException;

public class PingService {
    public void ping(String host) throws IOException {
        if (!host.matches("[a-zA-Z0-9.-]+")) {
            throw new IllegalArgumentException("invalid host");
        }
        Runtime.getRuntime().exec(new String[] {"ping", "-c", "1", host});
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-002, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-002: OS Command Injection via Runtime.exec — Zennoxa Shield