Merge pull request #41189 from kalaiyarasiganeshalingam/fix

Fix system module security vulnerability
ballerina-platform · Aug 22, 2023 · 367d4a3 · 367d4a3
2 parents 095b040 + 563e17f
commit 367d4a3
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/stdlib/system/src/main/java/org/ballerinalang/stdlib/system/nativeimpl/Exec.java b/stdlib/system/src/main/java/org/ballerinalang/stdlib/system/nativeimpl/Exec.java
@@ -42,9 +42,11 @@ public class Exec {
     private static final Logger log = LoggerFactory.getLogger(Exec.class);
 
     public static Object exec(String command, MapValue<String, String> env, Object dir, ArrayValue args) {
-        List<String> commandList = new ArrayList<String>();
-        commandList.add(command);
-        commandList.addAll(Arrays.asList(args.getStringArray()));
+        String space = " ";
+        List<String> commandList = new ArrayList<String>(Arrays.asList(command.split(space)));
+        for (String arg : args.getStringArray()) {
+            commandList.addAll(Arrays.asList(arg.split(space)));
+        }
         ProcessBuilder pb = new ProcessBuilder(commandList);
         if (dir != null) {
             pb.directory(new File((String) dir));