Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
ID |
scala.inject.scala_inject_rule_commandinjection |
Severity |
low |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Inject |
Language |
Scala |
Description
The highlighted API is used to execute a system command. If unfiltered input is passed to this API, it can lead to arbitrary command execution.
Rationale
The highlighted API is used to execute a system command. If unfiltered input is passed to this API, it can lead to arbitrary command execution.
The following code illustrates a vulnerable pattern detected by this rule:
class Maintenance {
@throws[IOException]
def throughRuntime(supplied: String): Unit = {
val runtime = Runtime.getRuntime
runtime.exec(supplied)
runtime.exec(Array[String]("df"))
// VULNERABLE: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
runtime.exec(Array[String]("bash", supplied))
// A shell is what turns an argument into a command line.
// VULNERABLE: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
runtime.exec(Array[String]("/bin/sh", "-c", supplied))
}
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A05 : Injection.