From 767d41adb4be1fd923fc1410cb2b4028696b8cfe Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Mon, 14 Sep 2026 11:34:59 +0300 Subject: [PATCH] SetupUtils: pass chmod arguments to Runtime.exec as an array Runtime.exec(String) splits the concatenated command on whitespace, so a deployment URI containing spaces would be handed to /bin/chmod as several operands. Build the command as a String[] instead. Closes CodeQL alert java/concatenated-command-line https://github.com/OpenIdentityPlatform/OpenAM/security/code-scanning/394 --- .../java/com/sun/identity/tools/bundles/SetupUtils.java | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/openam-core/src/main/java/com/sun/identity/tools/bundles/SetupUtils.java b/openam-core/src/main/java/com/sun/identity/tools/bundles/SetupUtils.java index faec4296ce..9aafe90743 100755 --- a/openam-core/src/main/java/com/sun/identity/tools/bundles/SetupUtils.java +++ b/openam-core/src/main/java/com/sun/identity/tools/bundles/SetupUtils.java @@ -28,6 +28,7 @@ /* * Portions Copyrighted 2011-2013 ForgeRock AS + * Portions Copyrighted 2026 3A Systems, LLC */ package com.sun.identity.tools.bundles; @@ -453,8 +454,10 @@ public static void copyAndFilterScripts(ResourceBundle bundle, CopyUtils.copyFile(srcFile, destFile, tokens, true, false); } if (! currentOS.equals(WINDOWS)) { - Process proc = Runtime.getRuntime().exec("/bin/chmod -R +x " + - toDir.getName()); + // Pass the directory as a separate argument so a name containing + // whitespace is not split into extra chmod operands. + Process proc = Runtime.getRuntime().exec(new String[] { + "/bin/chmod", "-R", "+x", toDir.getName()}); try { if (proc.waitFor() != 0) { System.out.println(bundle.getString("message.info." +