Zennoxa Shield
Rules / Java
SHIELD-JAVA-003

OS Command Injection via ProcessBuilder

criticalJavaCWE-78CVSS 9.8

What it detects

ProcessBuilder constructed with concatenated arguments permits command injection.

How to fix

Use a fixed argument list and validate or allowlist any user-controlled arguments.

Vulnerable — Shield flags thisBackupTool.java
import java.io.IOException;

public class BackupTool {
    public Process compress(String fileName) throws IOException {
        ProcessBuilder pb = new ProcessBuilder("sh", "-c", "tar czf backup.tar.gz " + fileName);
        return pb.start();
    }
}
Fixed — scans cleanBackupTool.java
import java.io.IOException;

public class BackupTool {
    public Process compress(String fileName) throws IOException {
        if (!fileName.matches("[\\w.-]+")) {
            throw new IllegalArgumentException("invalid file name");
        }
        ProcessBuilder pb = new ProcessBuilder("tar", "czf", "backup.tar.gz", fileName);
        return pb.start();
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-003, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-003: OS Command Injection via ProcessBuilder — Zennoxa Shield