Description

Detects command injection vulnerabilities in Kotlin code where user-controlled input can be executed as system commands. This occurs when untrusted data from user connections flows into dangerous runtime execution methods like 'exec' or 'loadLibrary', potentially allowing attackers to execute arbitrary system commands.

Detection Strategy

• Check for calls to dangerous methods 'loadLibrary' or 'exec'

• Verify these methods are called on a Runtime instance (via getRuntime)

• Confirm the command arguments originate from UserConnection, indicating user-controlled input

• Flag as vulnerable when all conditions are met - dangerous method called on Runtime with user input

Vulnerable code example

import javax.servlet.http.HttpServletRequest

fun processCommand(request: HttpServletRequest) {
    val userInput = request.getParameter("input") ?: ""
    val process = Runtime.getRuntime()
    // Vulnerable: Direct concatenation of user input into command string
    process.exec("ls " + userInput)
}

✅ Secure code example

import javax.servlet.http.HttpServletRequest

fun processCommand(request: HttpServletRequest) {
    val userInput = request.getParameter("input") ?: ""
    
    // Validate input against allowed pattern (alphanumeric + some safe chars)
    if (!userInput.matches(Regex("^[a-zA-Z0-9_.\\-]+$"))) {
        throw IllegalArgumentException("Invalid input characters")...