| Note | ||
|---|---|---|
| ||
This guideline has been deprecated. |
Both environment variables and system properties provide user-defined mappings between keys and their corresponding values and can be used to communicate those values from the environment to a process. According to the Java API [API 2014] java.lang.System class documentation:
...
Untrusted environment variables can provide data for injection and other attacks if not properly sanitized.
Rule | Severity | Likelihood | Detectable |
|---|
Repairable | Priority | Level | |
|---|---|---|---|
ENV02-J | Low | Likely | Yes |
No |
P6 | L2 |
Automated Detection
| Tool | Version | Checker | Description |
|---|---|---|---|
| Parasoft Jtest |
| CERT.ENV02.ENV | Do not use the non-portable 'System.getenv()' method | |||||||
| PVS-Studio |
| V6110 |
Android Implementation Details
On Android, the environment variable user.name is not used and is left blank. However, environment variables exist and are used on Android, so the rule is applicable.
Bibliography
...
...