CODEWITHSUNDEEP
javashellescaping
Yablargo
Yablargo

Reputation: 3596

Escaping Shell Commands In java?

I have a webservice that will take some input from authenticated machines as XML (this is for a network management system that I am integrating with some other software) and execute a shell script with some of the XML data as arguments.

In Java(/Linux), what is the best way to escape shell commands to ensure someone cannot pass malicious arguments to my webservice?

Basically in an extremely simplified example, Im taking some input in via WS

<foo>
<bar>ABCDEF</bar>
</foo>

then running somescript.pl <<data in <bar> field>> here

I need to ensure that this cannot be used to execute arbitrary shell commands,etc.

Thanks!

Upvotes: 19

Views: 8979

Answers (3)

0x89
0x89

Reputation: 2920

If you can't use a ProcessBuilder you can consider Apache commons-text escapeXSI.

(never mind the name - XSI is the X/Open System Interfaces Extension, a supplementary specification to the Single UNIX Specification, so everything that tries to be UNIX-like more or less complies with this).

Upvotes: 3

user1050755
user1050755

Reputation: 11691

Patch supplied: https://issues.apache.org/jira/browse/LANG-1066

That's really a long-standing issue.

Upvotes: 3

user166390
user166390

Reputation:

I would suggest using ProcessBuilder or one of the Runtime.exec methods which does not run through the shell and thus does not require shell escaping to avoid injection attacks (here).

It may also beneficial to consider using the process's STDIN pipe to transfer the XML data -- Perl can trivially handle reading from STDIN. There are generally limits with command-line arguments.

Happy coding.

Upvotes: 15

Related Questions