| Note | ||
|---|---|---|
| ||
This guideline has been deprecated. |
Both environment variables and system properties provide user-defined mappings between keys and their corresponding values and can be used to communicate those values from the environment to a process. According to the Java API [API 2014] java.lang.System class documentation:
...
Untrusted environment variables can provide data for injection and other attacks if not properly sanitized.
Rule | Severity | Likelihood | Detectable | Remediation CostRepairable | Priority | Level |
|---|---|---|---|---|---|---|
ENV02-J | Low | Likely | Yes | LowNo | P9P6 | L2 |
Automated Detection
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Parasoft Jtest |
| CERT.ENV02.ENV | Do not use the non-portable 'System.getenv()' method | ||||||
| PVS-Studio |
| V6110 |
...