[AppSecAI Agent] Uncontrolled command line

[conviso-platform-appsec]

AppSecAI Agent

Issue ID: 8860292
Title: Uncontrolled command line
Severity: CRITICAL
Type: SastFinding

Description

Using externally controlled strings in a command line is vulnerable to malicious changes in the strings.

Code that passes user input directly to Runtime.exec, or some other library routine that executes a command, allows the user to execute malicious code.

Fix Details

Security Fix: Uncontrolled Command Line Injection in lerArquivo Method

Vulnerability

The lerArquivo method in ArquivoServiceImpl was vulnerable to OS Command Injection (CWE-78). The method accepted a user-controlled nome parameter and passed it directly into a shell command via Runtime.exec:

command = new String[]{"sh", "-c", "cat " + nome};
Runtime rt = Runtime.getRuntime();
Process proc = rt.exec(command);

Because the nome parameter was concatenated directly into a shell command string executed with sh -c, an attacker could inject arbitrary shell commands. For example, passing nome as "/etc/passwd; rm -rf /" would execute both cat /etc/passwd and rm -rf /.

Fix

The fix eliminates the use of Runtime.exec entirely and replaces it with Java's built-in NIO Files.readAllBytes API, which reads file contents safely without invoking a shell:

1. Removed Runtime.exec usage: The shell command execution (sh -c cat <nome>) has been completely removed.
2. Used Java NIO for file reading: Files.readAllBytes(Path) is used instead, which does not involve any shell interpretation.
3. Added input validation: The file path is normalized using Paths.get(nome).normalize() and validated against a whitelist regex pattern ([a-zA-Z0-9_.\-/\\: ]+) to reject paths containing shell metacharacters or other dangerous characters.
4. Throws SecurityException for invalid paths: If the path contains disallowed characters, a SecurityException is thrown before any file access occurs.

Impact

• Eliminates the OS command injection vulnerability.
• Maintains the original functionality of reading and returning file contents as a string.
• No external dependencies added; uses standard Java NIO APIs.

---

This PR was automatically created by Conviso Platform Auto-Fix.