In Java it's common to see code such as
System.getProperty('line.separator') which is used to build Strings used for output, etc. It has been recommended by vulnerability scanners that it is advisable to validate this input by e.g. ensuring it matches
But I wonder, since Java itself is vulnerable to these within its own
PrintWriter.printLn and possibly
BufferedWriter.newLine() etc., is it now a best practice to validate
System.getProperty('line.separator') within every program that issues new line statements? It seems overkill.
Is there some alternate best practice that would obviate the need to validate all System properties? E.g. is it sufficient as a best practice to review the privileges and commands at the sysadmin level rather than at the developer level? If not, why are vulnerability scanners taking these precautions now?
My impression is that this kind of validation at the code level is overkill in a standard corporate production environment where there are multiple levels of separation of duties and privilege lockdowns among dev/test/prod etc. This is just my opinion however, and I would like to hear others'.