fix: remove unsafe exec() in App.java

[orbisai0security]

Summary

Fix critical severity security issue in page-object/src/main/java/com/iluwatar/pageobject/App.java.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	page-object/src/main/java/com/iluwatar/pageobject/App.java:80
CWE	CWE-78

Description: The application uses Runtime.exec() with string concatenation to execute system commands, directly concatenating the applicationFile variable into the command string without validation or sanitization. This creates a critical command injection vulnerability where attackers can inject arbitrary commands using shell metacharacters (&, |, ;, &&, ||). The use of 'cmd.exe start' with concatenated user-controlled input allows complete bypass of intended command execution, enabling attackers to execute any system command with the privileges of the Java application.

Changes

• page-object/src/main/java/com/iluwatar/pageobject/App.java

Verification

• Build not verified
• Scanner re-scan not performed
• LLM code review not performed

---

Automated security fix by OrbisAI Security

[github-actions]

PR Summary

Addresses a critical command injection vulnerability in App.java by replacing the unsafe Runtime.exec usage with a safe ProcessBuilder invocation. The new approach passes arguments explicitly to Windows' cmd.exe to start the application file, using applicationFile.getAbsolutePath() to avoid string concatenation and eliminate shell command injection risk.

Changes

File	Summary
page-object/src/main/java/com/iluwatar/pageobject/App.java	Replaced the risky string-concatenated Runtime.exec call with a safe ProcessBuilder invocation to launch the Windows start command using the application file's absolute path, preventing command injection.

---

autogenerated by presubmit.ai

[github-actions]

✅ LGTM!

Review Summary

Commits Considered (1)

• ccc014d: fix: V-001 security vulnerability

Automated security fix generated by Orbis Security AI

Files Processed (1)

• page-object/src/main/java/com/iluwatar/pageobject/App.java (1 hunk)

Actionable Comments (0)

Skipped Comments (1)

• page-object/src/main/java/com/iluwatar/pageobject/App.java [80-80]

  security: "Security improvement: use ProcessBuilder to avoid command injection"

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud