From eb62f8a27689502850ea229421c9b574435a1845 Mon Sep 17 00:00:00 2001
From: "conviso-platform-appsec[bot]"
 <70168064+conviso-platform-appsec[bot]@users.noreply.github.com>
Date: Tue, 18 Aug 2026 19:43:12 +0000
Subject: [PATCH] Fix Uncontrolled command line (Conviso Issue 8860292)

---
 .../service/arquivo/ArquivoServiceImpl.java   | 34 ++++++++-----------
 1 file changed, 14 insertions(+), 20 deletions(-)

diff --git a/advocacia/src/main/java/br/com/advocacia/service/arquivo/ArquivoServiceImpl.java b/advocacia/src/main/java/br/com/advocacia/service/arquivo/ArquivoServiceImpl.java
index 2d22e29..792c92b 100644
--- a/advocacia/src/main/java/br/com/advocacia/service/arquivo/ArquivoServiceImpl.java
+++ b/advocacia/src/main/java/br/com/advocacia/service/arquivo/ArquivoServiceImpl.java
@@ -118,28 +118,22 @@ public List<Arquivo> findAllModelo() {
     @Override
     public String lerArquivo(String nome) {
         StringBuilder strOut = new StringBuilder();
-        try{
-            String[] command;
-            command = new String[]{"sh", "-c", "cat " + nome};
-            //command = new String[]{"cmd.exe", "/c", "type " + nome};
-
-            Runtime rt = Runtime.getRuntime();
-            Process proc = rt.exec(command);
-            int result = proc.waitFor();
-            if(result != 0){
-                System.out.println("process error");
-            }
-            InputStream in = (result == 0) ? proc.getInputStream():proc.getErrorStream();
-            int c;
-            while((c=in.read())!= -1){
-                strOut.append((char) c);
+        try {
+            // Validate and sanitize the file path to prevent command injection
+            Path filePath = Paths.get(nome).normalize();
+
+            // Ensure the path does not contain shell metacharacters or path traversal
+            String sanitizedPath = filePath.toString();
+            if (!sanitizedPath.matches("[a-zA-Z0-9_.\\-/\\\\: ]+")) {
+                throw new SecurityException("Invalid file path: contains disallowed characters.");
             }
-            return strOut.toString();
 
-    }catch(Exception e){
-        return e.toString();
-    }
+            // Use Java NIO to read the file instead of executing a shell command
+            byte[] fileBytes = Files.readAllBytes(filePath);
+            return new String(fileBytes);
 
+        } catch (Exception e) {
+            return e.toString();
+        }
     }
 }
-