From 8328a256e6431ebac9fda306f479ffaa1ba920ca Mon Sep 17 00:00:00 2001
From: Chuck Aude <21095583+chuckaude@users.noreply.github.com>
Date: Thu, 11 Dec 2025 10:17:58 -0800
Subject: [PATCH 1/6] add CommandInjection.java

---
 src/main/java/CommandInjection.java | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 src/main/java/CommandInjection.java

diff --git a/src/main/java/CommandInjection.java b/src/main/java/CommandInjection.java
new file mode 100644
index 00000000..26162af8
--- /dev/null
+++ b/src/main/java/CommandInjection.java
@@ -0,0 +1,13 @@
+// https://documentation.blackduck.com/bundle/coverity-docs/page/checker-ref/checkers/NO/os_cmd_injection.html
+
+import java.io.*;
+import javax.servlet.http.HttpServletRequest;
+
+public class CommandInjection {
+    public static Process runCmd(HttpServletRequest request) throws IOException {
+        String filename = request.getParameter("filename");
+        ProcessBuilder builder = new ProcessBuilder("cat", filename);
+        Process process = builder.start();
+        return(process);
+    }
+}

From 93523dac4996ea03cda782318046db7fe6cb1cd8 Mon Sep 17 00:00:00 2001
From: Chuck Aude <21095583+chuckaude@users.noreply.github.com>
Date: Thu, 11 Dec 2025 10:19:57 -0800
Subject: [PATCH 2/6] Fix command syntax for Polaris PR Scan

---
 .github/workflows/polaris-signal-pr.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/polaris-signal-pr.yml b/.github/workflows/polaris-signal-pr.yml
index b3df879c..12699f72 100644
--- a/.github/workflows/polaris-signal-pr.yml
+++ b/.github/workflows/polaris-signal-pr.yml
@@ -35,4 +35,4 @@ jobs:
       if: ${{ github.event_name == 'pull_request' }}
       run: |
         CHANGESET=$(git diff --name-only -r HEAD^1 HEAD | xargs)
-        $HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} --$CHANGESET
+        $HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} $CHANGESET

From 52873f8b3d4bbfe974459553342635375fad6db0 Mon Sep 17 00:00:00 2001
From: Chuck Aude <21095583+chuckaude@users.noreply.github.com>
Date: Thu, 11 Dec 2025 10:22:05 -0800
Subject: [PATCH 3/6] Add error handling to Polaris PR Scan step

---
 .github/workflows/polaris-signal-pr.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/polaris-signal-pr.yml b/.github/workflows/polaris-signal-pr.yml
index 12699f72..af159020 100644
--- a/.github/workflows/polaris-signal-pr.yml
+++ b/.github/workflows/polaris-signal-pr.yml
@@ -34,5 +34,6 @@ jobs:
     - name: Polaris PR Scan
       if: ${{ github.event_name == 'pull_request' }}
       run: |
+        set -ex
         CHANGESET=$(git diff --name-only -r HEAD^1 HEAD | xargs)
         $HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} $CHANGESET

From 8de965b89da698401e65d356fd61848de78e6348 Mon Sep 17 00:00:00 2001
From: Chuck Aude <21095583+chuckaude@users.noreply.github.com>
Date: Thu, 11 Dec 2025 10:44:28 -0800
Subject: [PATCH 4/6] Update signal command to target CommandInjection.java

Specify the file to analyze for command injection.
---
 .github/workflows/polaris-signal-pr.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/polaris-signal-pr.yml b/.github/workflows/polaris-signal-pr.yml
index af159020..f9fd4773 100644
--- a/.github/workflows/polaris-signal-pr.yml
+++ b/.github/workflows/polaris-signal-pr.yml
@@ -36,4 +36,4 @@ jobs:
       run: |
         set -ex
         CHANGESET=$(git diff --name-only -r HEAD^1 HEAD | xargs)
-        $HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} $CHANGESET
+        $HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} src/main/java/CommandInjection.java

From befa7c9e5c56148d32655c6b252444cc99324684 Mon Sep 17 00:00:00 2001
From: Chuck Aude <21095583+chuckaude@users.noreply.github.com>
Date: Thu, 11 Dec 2025 11:21:33 -0800
Subject: [PATCH 5/6] Comment out old CHANGESET commands in workflow

---
 .github/workflows/polaris-signal-pr.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/polaris-signal-pr.yml b/.github/workflows/polaris-signal-pr.yml
index f9fd4773..a4125a6f 100644
--- a/.github/workflows/polaris-signal-pr.yml
+++ b/.github/workflows/polaris-signal-pr.yml
@@ -35,5 +35,6 @@ jobs:
       if: ${{ github.event_name == 'pull_request' }}
       run: |
         set -ex
-        CHANGESET=$(git diff --name-only -r HEAD^1 HEAD | xargs)
-        $HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} src/main/java/CommandInjection.java
+        #CHANGESET=$(git diff --name-only -r HEAD^1 HEAD | xargs)
+        #$HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} $CHANGESET
+        $HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} --git-diff

From af15dc5826227cb6337e23876ebb1f1416fb8017 Mon Sep 17 00:00:00 2001
From: Chuck Aude <21095583+chuckaude@users.noreply.github.com>
Date: Thu, 11 Dec 2025 11:27:02 -0800
Subject: [PATCH 6/6] Update polaris-signal-pr.yml

---
 .github/workflows/polaris-signal-pr.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/polaris-signal-pr.yml b/.github/workflows/polaris-signal-pr.yml
index a4125a6f..075b6973 100644
--- a/.github/workflows/polaris-signal-pr.yml
+++ b/.github/workflows/polaris-signal-pr.yml
@@ -37,4 +37,4 @@ jobs:
         set -ex
         #CHANGESET=$(git diff --name-only -r HEAD^1 HEAD | xargs)
         #$HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} $CHANGESET
-        $HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} --git-diff
+        $HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} --git-diff .