From fcdf639b15f09acb163e2f0d7772f13f184b52da Mon Sep 17 00:00:00 2001 From: OrbisAI Security Date: Wed, 10 Jun 2026 21:39:13 +0530 Subject: [PATCH] fix: remove unsafe exec() in page controller App.java (#3471) * fix: V-002 security vulnerability Automated security fix generated by Orbis Security AI * adding cross-platform support * fixing sonarqube hotspots * fixing the formating for java windows * fix: address PR review comments - Windows title bug, Unix paths, and consistency - Add empty string title arg to cmd /c start to fix paths-with-spaces bug - Revert Unix commands to bare names (open, xdg-open) with NOSONAR since xdg-open location varies by distro; absolute paths broke portability - Apply same ProcessBuilder fix to page-object/src App.java for consistency Co-Authored-By: Claude Sonnet 4.6 * fix: resolve Windows path via SystemRoot env var instead of hardcoding C:\Windows\System32\cmd.exe fails when Windows is installed on a non-C drive. Use System.getenv("SystemRoot") with a C:\Windows fallback to locate cmd.exe portably in both App.java files. Co-Authored-By: Claude Sonnet 4.6 --------- Co-authored-by: Claude Sonnet 4.6 --- .../java/com/iluwatar/pageobject/App.java | 25 ++++++++++++++++-- .../java/com/iluwatar/pageobject/App.java | 26 ++++++++++++++++--- 2 files changed, 46 insertions(+), 5 deletions(-) diff --git a/page-object/sample-application/src/main/java/com/iluwatar/pageobject/App.java b/page-object/sample-application/src/main/java/com/iluwatar/pageobject/App.java index aaf19fb0c..feac06124 100644 --- a/page-object/sample-application/src/main/java/com/iluwatar/pageobject/App.java +++ b/page-object/sample-application/src/main/java/com/iluwatar/pageobject/App.java @@ -27,6 +27,7 @@ package com.iluwatar.pageobject; import java.awt.Desktop; import java.io.File; import java.io.IOException; +import java.util.Locale; import lombok.extern.slf4j.Slf4j; /** @@ -77,8 +78,28 @@ public final class App { Desktop.getDesktop().open(applicationFile); } else { - // java Desktop not supported - above unlikely to work for Windows so try instead... - Runtime.getRuntime().exec("cmd.exe start " + applicationFile); + // java Desktop not supported - use ProcessBuilder for cross-platform support + var os = System.getProperty("os.name").toLowerCase(Locale.ROOT); + ProcessBuilder pb; + if (os.contains("win")) { + // Empty string title arg prevents cmd start treating a quoted path as the window title + var systemRoot = System.getenv("SystemRoot"); + if (systemRoot == null) { + systemRoot = "C:\\Windows"; + } + pb = + new ProcessBuilder( + systemRoot + "\\System32\\cmd.exe", + "/c", + "start", + "", + applicationFile.getAbsolutePath()); + } else if (os.contains("mac")) { + pb = new ProcessBuilder("open", applicationFile.getAbsolutePath()); // NOSONAR + } else { + pb = new ProcessBuilder("xdg-open", applicationFile.getAbsolutePath()); // NOSONAR + } + pb.start(); } } catch (IOException ex) { diff --git a/page-object/src/main/java/com/iluwatar/pageobject/App.java b/page-object/src/main/java/com/iluwatar/pageobject/App.java index 214858cdc..2b104a583 100644 --- a/page-object/src/main/java/com/iluwatar/pageobject/App.java +++ b/page-object/src/main/java/com/iluwatar/pageobject/App.java @@ -27,6 +27,7 @@ package com.iluwatar.pageobject; import java.awt.Desktop; import java.io.File; import java.io.IOException; +import java.util.Locale; /** * Page Object pattern wraps an UI component with an application specific API allowing you to @@ -75,9 +76,28 @@ public final class App { Desktop.getDesktop().open(applicationFile); } else { - // Java Desktop not supported - above unlikely to work for Windows so try the - // following instead... - new ProcessBuilder("cmd.exe", "/c", "start", "", applicationFile.getAbsolutePath()).start(); + // java Desktop not supported - use ProcessBuilder for cross-platform support + var os = System.getProperty("os.name").toLowerCase(Locale.ROOT); + ProcessBuilder pb; + if (os.contains("win")) { + // Empty string title arg prevents cmd start treating a quoted path as the window title + var systemRoot = System.getenv("SystemRoot"); + if (systemRoot == null) { + systemRoot = "C:\\Windows"; + } + pb = + new ProcessBuilder( + systemRoot + "\\System32\\cmd.exe", + "/c", + "start", + "", + applicationFile.getAbsolutePath()); + } else if (os.contains("mac")) { + pb = new ProcessBuilder("open", applicationFile.getAbsolutePath()); // NOSONAR + } else { + pb = new ProcessBuilder("xdg-open", applicationFile.getAbsolutePath()); // NOSONAR + } + pb.start(); } } catch (IOException ex) {