[Autofix] Add allow-list for env var in BenchmarkTest01190 to fix cmd injection

[rafikmojr]

Autofix: Fixed 1 of 1 security risk(s)

✅ Fixed

• SAST · View in Apiiro

  • Summary:
    Added a strict allow-list check for the user-controlled environment variable value before it is passed to Runtime.exec in BenchmarkTest01190.java, blocking OS command injection via header-controlled env vars (e.g. LD_PRELOAD).

  • What Changed:
    In src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01190.java, after the bar variable is populated from the BenchmarkTest01190 HTTP header via doSomething, a new block constructs an immutable Set<String> of permitted environment-variable values ("safe1", "safe2", "safe3") and rejects the request with an error message before reaching Runtime.exec whenever bar is null or not in that set. The subsequent exec(args, argsEnv) call is therefore only reached with an allow-listed value. No imports were added because the new code uses fully-qualified java.util.* classes.

  • Why This Fix:
    The overlay's remediation guidance and code example prescribe an allow-list of known-safe values as the correct defense for this CWE-78 pattern, and explicitly warn against sanitization or block-listing. An allow-list is the narrowest, most defensible control here because the env var has no legitimate free-form content — any deviation is malicious. A broader refactor (e.g. removing the env-var pass-through entirely) would alter the benchmark's public test surface; a focused allow-list gate matches the overlay's recommended pattern while keeping the servlet's observable shape intact.

  • Files Changed:

    • src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01190.java

  • Reviewer Notes:

    • This file is part of the OWASP Benchmark test corpus (expectedresults-1.2.csv marks BenchmarkTest01190,cmdi,true,78). Adding the allow-list gate changes the intentionally-vulnerable fixture into a safe one, which will cause SAST tools under test to flip this row from a True Positive to a False N…
    • Confirm the three placeholder allow-list values (safe1, safe2, safe3) are acceptable; the original code has no legitimate consumers, so no real values exist to preserve.

  • Potential Impact:
    Low–medium runtime impact: requests to /cmdi-01/BenchmarkTest01190 whose BenchmarkTest01190 header is not in the three-element allow-list will now receive an error string instead of triggering Runtime.exec. Because the file is an intentionally-vulnerable benchmark fixture, the main side effect is that SAST/DAST tools scoring against this corpus will see the command-injection sink as guarded, which may shift scorecard metrics for this test case.

---

About Apiiro Autofix

This PR was automatically generated by Apiiro Autofix. Review all changes carefully before merging and run your test suite to verify no regressions.

[karencapiiro]

Checkmarx One – Scan Summary & Details – 007075ef-4236-4cff-9f00-8b4cb06e2ba0

---

New Issues (2512)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01674.java: 43	Attack Vector
2		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02244.java: 43	Attack Vector
3		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02059.java: 44	Attack Vector
4		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02243.java: 43	Attack Vector
5		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01929.java: 45	Attack Vector
6		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01601.java: 43	Attack Vector
7		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01430.java: 45	Attack Vector
8		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02250.java: 43	Attack Vector
9		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01938.java: 45	Attack Vector
10		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02343.java: 45	Attack Vector
11		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02249.java: 43	Attack Vector
12		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01673.java: 43	Attack Vector
13		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02611.java: 43	Attack Vector
14		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02333.java: 45	Attack Vector
15		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01441.java: 45	Attack Vector
16		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01446.java: 45	Attack Vector
17		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02151.java: 43	Attack Vector
18		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02067.java: 44	Attack Vector
19		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01189.java: 44	Attack Vector
20		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00304.java: 44	Attack Vector
21		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01943.java: 45	Attack Vector
22		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01936.java: 45	Attack Vector
23		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01193.java: 44	Attack Vector
24		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01286.java: 43	Attack Vector
25		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00159.java: 45	Attack Vector
26		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01609.java: 43	Attack Vector
27		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01064.java: 45	Attack Vector
28		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00568.java: 45	Attack Vector
29		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02340.java: 45	Attack Vector
30		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02334.java: 45	Attack Vector
31		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00294.java: 44	Attack Vector
32		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00303.java: 44	Attack Vector
33		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00293.java: 44	Attack Vector
34		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00824.java: 43	Attack Vector
35		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01687.java: 43	Attack Vector
36		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01685.java: 43	Attack Vector
37		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00732.java: 43	Attack Vector
38		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01362.java: 43	Attack Vector
39		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00295.java: 44	Attack Vector
40		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00575.java: 45	Attack Vector
41		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01940.java: 45	Attack Vector
42		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01850.java: 57	Attack Vector
43		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01851.java: 57	Attack Vector
44		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00968.java: 57	Attack Vector
45		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00970.java: 57	Attack Vector
46		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01353.java: 43	Attack Vector
47		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02251.java: 43	Attack Vector
48		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02252.java: 43	Attack Vector
49		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02253.java: 43	Attack Vector
50		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02069.java: 44	Attack Vector
51		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01194.java: 44	Attack Vector
52		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00481.java: 43	Attack Vector
53		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02152.java: 43	Attack Vector
54		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01285.java: 43	Attack Vector
55		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02146.java: 43	Attack Vector
56		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01852.java: 57	Attack Vector
57		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00171.java: 45	Attack Vector
58		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00576.java: 45	Attack Vector
59		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01443.java: 45	Attack Vector
60		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01440.java: 45	Attack Vector
61		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02342.java: 45	Attack Vector
62		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01693.java: 43	Attack Vector
63		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00816.java: 43	Attack Vector
64		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01672.java: 43	Attack Vector
65		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01365.java: 43	Attack Vector
66		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00979.java: 57	Attack Vector
67		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00407.java: 43	Attack Vector
68		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01607.java: 43	Attack Vector
69		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00158.java: 45	Attack Vector
70		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00567.java: 45	Attack Vector
71		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01928.java: 45	Attack Vector
72		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01065.java: 45	Attack Vector
73		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01270.java: 43	Attack Vector
74		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01689.java: 43	Attack Vector
75		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01688.java: 43	Attack Vector
76		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01360.java: 43	Attack Vector
77		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01610.java: 43	Attack Vector
78		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02137.java: 43	Attack Vector
79		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00981.java: 57	Attack Vector
80		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01068.java: 45	Attack Vector
81		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01944.java: 45	Attack Vector
82		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01942.java: 45	Attack Vector
83		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00814.java: 43	Attack Vector
84		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00742.java: 43	Attack Vector
85		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00731.java: 43	Attack Vector
86		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02496.java: 43	Attack Vector
87		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00480.java: 43	Attack Vector
88		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02150.java: 43	Attack Vector
89		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02149.java: 43	Attack Vector
90		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00077.java: 57	Attack Vector
91		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02154.java: 43	Attack Vector
92		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00015.java: 46	Attack Vector
93		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00310.java: 44	Attack Vector
94		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00308.java: 44	Attack Vector
95		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00302.java: 44	Attack Vector
96		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00815.java: 43	Attack Vector
97		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01606.java: 43	Attack Vector
98		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01269.java: 43	Attack Vector
99		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01864.java: 57	Attack Vector
100		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00572.java: 45	Attack Vector
101		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00826.java: 43	Attack Vector
102		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00500.java: 43	Attack Vector
103		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00499.java: 43	Attack Vector
104		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00739.java: 43	Attack Vector
105		Command_Injection	src/main/java/org/owasp/benchmark/helpers/SeparateClassRequest.java: 33	Attack Vector
106		Command_Injection	src/main/java/org/owasp/benchmark/helpers/SeparateClassRequest.java: 33	Attack Vector
107		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00396.java: 43	Attack Vector
108		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00406.java: 43	Attack Vector
109		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00408.java: 43	Attack Vector
110		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00409.java: 43	Attack Vector
111		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00176.java: 45	Attack Vector
112		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00177.java: 45	Attack Vector
113		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00006.java: 47	Attack Vector
114		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00738.java: 43	Attack Vector

More results are available on the CxOne platform

---

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.