@@ -33,7 +33,6 @@ public void safe2(String userInput) throws IOException, URISyntaxException {
3333 public void bad3 (HttpServletRequest request ) throws IOException , URISyntaxException {
3434 String url = request .getParameter ("url" );
3535 URI uri = new URI (url );
36-
3736 // Weak check - only checks if scheme exists, not what it is
3837 if (uri .getScheme () != null ) {
3938 Desktop .getDesktop ().browse (uri );
@@ -43,7 +42,6 @@ public void bad3(HttpServletRequest request) throws IOException, URISyntaxExcept
4342 public void safe3 (String userInput ) throws IOException , URISyntaxException {
4443 URI uri = new URI (userInput );
4544 String scheme = uri .getScheme ();
46-
4745 if (scheme != null && (scheme .equalsIgnoreCase ("http" ) || scheme .equalsIgnoreCase ("https" ))) {
4846 Desktop .getDesktop ().browse (uri );
4947 }
@@ -53,22 +51,13 @@ public void safe4() throws IOException, URISyntaxException {
5351 Desktop .getDesktop ().browse (new URI ("https://example.com" ));
5452 }
5553
56- // rundll32 test cases
57- public void bad4_rundll32 (HttpServletRequest request ) throws IOException {
58- String url = request .getParameter ("url" );
59- // Single string command with concatenation
60- Runtime .getRuntime ().exec ("rundll32 url.dll,FileProtocolHandler " + url );
61- }
62-
63- public void bad5_rundll32 (String userInput ) throws IOException {
64- // Array-based command
54+ public void bad4_rundll32 (String userInput ) throws IOException {
6555 String [] cmd = { "rundll32" , "url.dll,FileProtocolHandler" , userInput };
6656 Runtime .getRuntime ().exec (cmd );
6757 }
6858
6959 public void bad6_rundll32 (HttpServletRequest request ) throws IOException {
7060 String url = request .getParameter ("url" );
71- // ProcessBuilder with list
7261 ProcessBuilder pb = new ProcessBuilder ("rundll32" , "url.dll,FileProtocolHandler" , url );
7362 pb .start ();
7463 }
@@ -77,7 +66,8 @@ public void safe5_rundll32(HttpServletRequest request) throws IOException, URISy
7766 String url = request .getParameter ("url" );
7867 URI uri = new URI (url );
7968 if (uri .getScheme ().equals ("https" ) || uri .getScheme ().equals ("http" )) {
80- Runtime .getRuntime ().exec ("rundll32 url.dll,FileProtocolHandler " + url );
69+ String [] cmd = { "rundll32" , "url.dll,FileProtocolHandler" , url };
70+ Runtime .getRuntime ().exec (cmd );
8171 }
8272 }
8373
@@ -92,13 +82,7 @@ public void safe7_rundll32() throws IOException {
9282 Runtime .getRuntime ().exec ("rundll32 url.dll,FileProtocolHandler https://example.com" );
9383 }
9484
95- // xdg-open test cases (Linux)
96- public void bad7_xdgopen (HttpServletRequest request ) throws IOException {
97- String url = request .getParameter ("url" );
98- Runtime .getRuntime ().exec ("xdg-open " + url );
99- }
100-
101- public void bad8_xdgopen (String userInput ) throws IOException {
85+ public void bad7_xdgopen (String userInput ) throws IOException {
10286 String [] cmd = { "xdg-open" , userInput };
10387 Runtime .getRuntime ().exec (cmd );
10488 }
@@ -107,33 +91,8 @@ public void safe8_xdgopen(HttpServletRequest request) throws IOException, URISyn
10791 String url = request .getParameter ("url" );
10892 URI uri = new URI (url );
10993 if (uri .getScheme ().equals ("https" ) || uri .getScheme ().equals ("http" )) {
110- Runtime .getRuntime ().exec ("xdg-open " + url );
111- }
112- }
113-
114- public void safe9_xdgopen () throws IOException {
115- Runtime .getRuntime ().exec ("xdg-open https://example.com" );
116- }
117-
118- // open test cases (macOS)
119- public void bad9_open (HttpServletRequest request ) throws IOException {
120- String url = request .getParameter ("url" );
121- Runtime .getRuntime ().exec ("open " + url );
122- }
123-
124- public void bad10_open (String userInput ) throws IOException {
125- ProcessBuilder pb = new ProcessBuilder ("open" , userInput );
126- pb .start ();
127- }
128-
129- public void safe10_open (HttpServletRequest request ) throws IOException , URISyntaxException {
130- String url = request .getParameter ("url" );
131- if (url .startsWith ("https://" ) || url .startsWith ("http://" )) {
132- Runtime .getRuntime ().exec ("/usr/bin/open " + url );
94+ String [] cmd = { "xdg-open" , url };
95+ Runtime .getRuntime ().exec (cmd );
13396 }
13497 }
135-
136- public void safe11_open () throws IOException {
137- Runtime .getRuntime ().exec ("open https://example.com" );
138- }
13998}
0 commit comments