tiennm99/java-design-patterns
1
0
Fork 0
mirror of https://github.com/tiennm99/java-design-patterns.git synced 2026-09-12 08:18:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: remove unsafe exec() in page controller App.java (#3471)

Browse Source 
* fix: V-002 security vulnerability

Automated security fix generated by Orbis Security AI

* adding cross-platform support

* fixing sonarqube hotspots

* fixing the formating for java windows

* fix: address PR review comments - Windows title bug, Unix paths, and consistency

- Add empty string title arg to cmd /c start to fix paths-with-spaces bug
- Revert Unix commands to bare names (open, xdg-open) with NOSONAR since
  xdg-open location varies by distro; absolute paths broke portability
- Apply same ProcessBuilder fix to page-object/src App.java for consistency

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: resolve Windows path via SystemRoot env var instead of hardcoding

C:\Windows\System32\cmd.exe fails when Windows is installed on a
non-C drive. Use System.getenv("SystemRoot") with a C:\Windows
fallback to locate cmd.exe portably in both App.java files.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
OrbisAI Security
2026-06-10 19:09:13 +03:00
committed by GitHub
co-authored by Claude Sonnet 4.6
parent 39dce8eedf
commit fcdf639b15
2 changed files with 46 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
page-object/sample-application/src/main/java/com/iluwatar/pageobject/App.java
+23 -2
View File
@@ -27,6 +27,7 @@ package com.iluwatar.pageobject;
import java.awt.Desktop;
import java.io.File;
import java.io.IOException;
import java.util.Locale;
import lombok.extern.slf4j.Slf4j;
/**
@@ -77,8 +78,28 @@ public final class App {
Desktop.getDesktop().open(applicationFile);
} else {
// java Desktop not supported - above unlikely to work for Windows so try instead...
Runtime.getRuntime().exec("cmd.exe start " + applicationFile);
// java Desktop not supported - use ProcessBuilder for cross-platform support
var os = System.getProperty("os.name").toLowerCase(Locale.ROOT);
ProcessBuilder pb;
if (os.contains("win")) {
// Empty string title arg prevents cmd start treating a quoted path as the window title
var systemRoot = System.getenv("SystemRoot");
if (systemRoot == null) {
systemRoot = "C:\\Windows";
}
pb =
new ProcessBuilder(
systemRoot + "\\System32\\cmd.exe",
"/c",
"start",
"",
applicationFile.getAbsolutePath());
} else if (os.contains("mac")) {
pb = new ProcessBuilder("open", applicationFile.getAbsolutePath()); // NOSONAR
} else {
pb = new ProcessBuilder("xdg-open", applicationFile.getAbsolutePath()); // NOSONAR
}
pb.start();
}
} catch (IOException ex) {
page-object/src/main/java/com/iluwatar/pageobject/App.java
+23 -3
View File
@@ -27,6 +27,7 @@ package com.iluwatar.pageobject;
import java.awt.Desktop;
import java.io.File;
import java.io.IOException;
import java.util.Locale;
/**
* Page Object pattern wraps an UI component with an application specific API allowing you to
@@ -75,9 +76,28 @@ public final class App {
Desktop.getDesktop().open(applicationFile);
} else {
// Java Desktop not supported - above unlikely to work for Windows so try the
// following instead...
new ProcessBuilder("cmd.exe", "/c", "start", "", applicationFile.getAbsolutePath()).start();
// java Desktop not supported - use ProcessBuilder for cross-platform support
var os = System.getProperty("os.name").toLowerCase(Locale.ROOT);
ProcessBuilder pb;
if (os.contains("win")) {
// Empty string title arg prevents cmd start treating a quoted path as the window title
var systemRoot = System.getenv("SystemRoot");
if (systemRoot == null) {
systemRoot = "C:\\Windows";
}
pb =
new ProcessBuilder(
systemRoot + "\\System32\\cmd.exe",
"/c",
"start",
"",
applicationFile.getAbsolutePath());
} else if (os.contains("mac")) {
pb = new ProcessBuilder("open", applicationFile.getAbsolutePath()); // NOSONAR
} else {
pb = new ProcessBuilder("xdg-open", applicationFile.getAbsolutePath()); // NOSONAR
}
pb.start();
}
} catch (IOException ex) {