Skip to content

add CommandInjection.java #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
chuckaude wants to merge 6 commits into from
Closed

add CommandInjection.java #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8328a25
add CommandInjection.java
chuckaude Dec 11, 2025
93523da
Fix command syntax for Polaris PR Scan
chuckaude Dec 11, 2025
52873f8
Add error handling to Polaris PR Scan step
chuckaude Dec 11, 2025
8de965b
Update signal command to target CommandInjection.java
chuckaude Dec 11, 2025
befa7c9
Comment out old CHANGESET commands in workflow
chuckaude Dec 11, 2025
af15dc5
Update polaris-signal-pr.yml
chuckaude Dec 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .github/workflows/polaris-signal-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,5 +34,7 @@ jobs:
- name: Polaris PR Scan
if: ${{ github.event_name == 'pull_request' }}
run: |
CHANGESET=$(git diff --name-only -r HEAD^1 HEAD | xargs)
$HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} --$CHANGESET
set -ex
#CHANGESET=$(git diff --name-only -r HEAD^1 HEAD | xargs)
#$HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} $CHANGESET
$HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} --git-diff .
13 changes: 13 additions & 0 deletions src/main/java/CommandInjection.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
// https://documentation.blackduck.com/bundle/coverity-docs/page/checker-ref/checkers/NO/os_cmd_injection.html

import java.io.*;
import javax.servlet.http.HttpServletRequest;

public class CommandInjection {
public static Process runCmd(HttpServletRequest request) throws IOException {
String filename = request.getParameter("filename");
ProcessBuilder builder = new ProcessBuilder("cat", filename);
Process process = builder.start();
return(process);
}
}
Loading