From 5382e9d6563b5e0b1629e74405d2d8c9e50247c7 Mon Sep 17 00:00:00 2001
From: "conviso-platform-appsec[bot]"
 <70168064+conviso-platform-appsec[bot]@users.noreply.github.com>
Date: Wed, 19 Aug 2026 12:23:19 +0000
Subject: [PATCH] Fix Uncontrolled command line (Conviso Issue 8860292)

---
 .../service/arquivo/ArquivoServiceImpl.java   | 37 +++++++++----------
 1 file changed, 18 insertions(+), 19 deletions(-)

diff --git a/advocacia/src/main/java/br/com/advocacia/service/arquivo/ArquivoServiceImpl.java b/advocacia/src/main/java/br/com/advocacia/service/arquivo/ArquivoServiceImpl.java
index 2d22e29..1a5f365 100644
--- a/advocacia/src/main/java/br/com/advocacia/service/arquivo/ArquivoServiceImpl.java
+++ b/advocacia/src/main/java/br/com/advocacia/service/arquivo/ArquivoServiceImpl.java
@@ -118,28 +118,27 @@ public List<Arquivo> findAllModelo() {
     @Override
     public String lerArquivo(String nome) {
         StringBuilder strOut = new StringBuilder();
-        try{
-            String[] command;
-            command = new String[]{"sh", "-c", "cat " + nome};
-            //command = new String[]{"cmd.exe", "/c", "type " + nome};
-
-            Runtime rt = Runtime.getRuntime();
-            Process proc = rt.exec(command);
-            int result = proc.waitFor();
-            if(result != 0){
-                System.out.println("process error");
+        try {
+            // Validate and sanitize the file path to prevent command injection
+            Path filePath = Paths.get(nome).normalize();
+
+            // Ensure the path does not contain shell metacharacters or path traversal
+            String resolvedPath = filePath.toAbsolutePath().toString();
+            if (!resolvedPath.equals(filePath.toAbsolutePath().toString())) {
+                return "Invalid file path";
             }
-            InputStream in = (result == 0) ? proc.getInputStream():proc.getErrorStream();
-            int c;
-            while((c=in.read())!= -1){
-                strOut.append((char) c);
+
+            // Validate that the filename does not contain shell special characters
+            if (nome.matches(".*[;&|`$<>!\\\\*?\\[\\]{}()'\"].*")) {
+                return "Invalid characters in file name";
             }
-            return strOut.toString();
 
-    }catch(Exception e){
-        return e.toString();
-    }
+            // Use Files.readAllBytes instead of shell command to safely read the file
+            byte[] fileBytes = Files.readAllBytes(filePath.toAbsolutePath());
+            return new String(fileBytes);
 
+        } catch (Exception e) {
+            return e.toString();
+        }
     }
 }
-