while I understand that OS command injection needs to have the untrusted input to be validated, I see that people have been suggesting to use ProcessBuilder(...).start() over Runtime.getRuntime().exec(..); is this because ProcessBuilder does not take command to be executed as a single string?


I overcame this vulnerability by using ESAPI's executeSystemCommand method which internally seems to be using ProcessorBuilder after validating the input though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.