I am currently working on fixing some security problems with our webapp as reported by VeraCode. Some of these pertain to "trust boundaries", i.e, what inputs can be trusted.
In some cases, our problems appear to be due to our reading of Java system properties or of system environment variables. I can see how this could be a problem with a desktop application, where a user could set environment variables or properties and then start the application. However, in the case of a web application, where the web server startup happens under the care of a trusted administrator, it seems to me that the environment variables and system properties would be on the safe side of the trust boundary. Am I overlooking some way that the properties or variables could be misused?