Zennoxa Shield
Rules / Kotlin
SHIELD-KOTLIN-004

Command injection via ProcessBuilder with variable

criticalKotlinCWE-78CVSS 9.1

What it detects

ProcessBuilder constructed with an interpolated or concatenated variable can execute attacker-controlled commands.

How to fix

Pass a static list of arguments and never build the command line from untrusted data.

Vulnerable — Shield flags thisBuild.kt
fun runTool(userInput: String) {
    val cmd = listOf("sh", "-c", "convert $userInput out.png")
    ProcessBuilder(cmd).start()
}
Fixed — scans cleanBuild.kt
fun runTool(userFile: String) {
    require(userFile.matches(Regex("^[\\w./-]+$"))) { "invalid path" }
    ProcessBuilder("convert", userFile, "out.png").start()
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-004, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-KOTLIN-004: Command injection via ProcessBuilder with variable — Zennoxa Shield