Page History

...

Code Block

bgColor	#ccccff

// ...
String dir = null;

int number = Integer.parseInt(System.getpropertygetProperty("dir")); // only allow integer choices
switch (number) {
  case 1: 
    dir = "data1";
    break; // Option 1
  case 2: 
    dir = "data2";
    break; // Option 2
  default: // invalid
    break; 
}
if (dir == null) {
  // handle error
}

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="6c3a9e7b5e117fc8-7389cf57-48324ec7-a2f6954d-9d3f166f2af5d2fb0bd6afac"><ac:plain-text-body><![CDATA[	[CVE-2010-0886]	[Sun Java Web Start Plugin Command Line Argument Injection	http://www.securitytube.net/video/1465]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="5c04b9376ac5ce3b-143be190-40cd4faf-95488e60-f2747ec7e87574f1cf236dc2"><ac:plain-text-body><![CDATA[	[CVE-2010-1826]	[Command injection in updateSharingD's handling of Mach RPC messages	http://securitytracker.com/id/1024617]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="fcf3d4d5a664138a-e813f8a5-4d0545e5-95e58008-90973ef5e3fdaded0468b060"><ac:plain-text-body><![CDATA[	[T-472]	[Mac OS X Java Command Injection Flaw in updateSharingD Lets Local Users Gain Elevated Privileges	http://www.doecirc.energy.gov/bulletins/t-472.shtml]	]]></ac:plain-text-body></ac:structured-macro>

...

The CERT C Secure Coding Standard	ENV03-C. Sanitize the environment when invoking external programs
	ENV04-C. Do not call system() if you do not need a command processor
The CERT C++ Secure Coding Standard	ENV03-CPP. Sanitize the environment when invoking external programs
	ENV04-CPP. Do not call system() if you do not need a command processor
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="26d475f5233950a7-468fa553-452b431f-9fe2ae87-79bdbf4d58752fa773bdb87d"><ac:plain-text-body><![CDATA[	[ISO/IEC TR 24772:2010	http://www.aitcnet.org/isai/]	"Injection [RST]"	]]></ac:plain-text-body></ac:structured-macro>
MITRE CWE	CWE-78, "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="8900c6ea9bd2bc35-bac9b9b8-4acf4463-aec1aea2-bb57b1cebedbe4e3ebb0eda8"><ac:plain-text-body><![CDATA[	[[Chess 2007	AA. Bibliography#Chess 07]]	Chapter 5: Handling Input, "Command Injection"]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="10e9f9a5f417258f-519e3c0a-4d064b97-9d458195-25bce39068e13a302f5febda"><ac:plain-text-body><![CDATA[	[[OWASP 2005	AA. Bibliography#OWASP 05]]	[Reviewing Code for OS Injection	http://www.owasp.org/index.php/Reviewing_Code_for_OS_Injection]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="04ed705fd9ac896b-c14c6329-49cb4890-a410959f-c92b56f798e16e3aff1579c2"><ac:plain-text-body><![CDATA[	[[Permissions 2008	AA. Bibliography#Permissions 08]]	[Permissions in the Java™ SE 6 Development Kit (JDK)	http://java.sun.com/javase/6/docs/technotes/guides/security/permissions.html], Sun Microsystems, Inc. (2008)	]]></ac:plain-text-body></ac:structured-macro>

...

Space shortcuts

Page tree

Versions Compared

Old Version 116

New Version 117

Key