From 81c460f6755f8685837c71bf07ad16e1b6cd2cf2 Mon Sep 17 00:00:00 2001
From: Chuck Aude <21095583+chuckaude@users.noreply.github.com>
Date: Wed, 8 Apr 2026 13:53:56 -0700
Subject: [PATCH 1/2] add CommandInjection.java

---
 src/main/java/CommandInjection.java | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 src/main/java/CommandInjection.java

diff --git a/src/main/java/CommandInjection.java b/src/main/java/CommandInjection.java
new file mode 100644
index 00000000..71cec828
--- /dev/null
+++ b/src/main/java/CommandInjection.java
@@ -0,0 +1,13 @@
+// https://documentation.blackduck.com/bundle/coverity-docs/page/checker-ref/checkers/NO/os_cmd_injection.html
+
+import java.io.*;
+import javax.servlet.http.HttpServletRequest;
+
+public class CommandInjection {
+    public static Process runCmd(HttpServletRequest request) throws IOException {
+        String command = request.getParameter("command");
+        ProcessBuilder builder = new ProcessBuilder("sh", command);
+        Process process = builder.start();
+        return(process);
+    }
+}

From 80633bf65d8e7b591bd24e7eef4a772cdc1a0d90 Mon Sep 17 00:00:00 2001
From: Chuck Aude <21095583+chuckaude@users.noreply.github.com>
Date: Wed, 8 Apr 2026 14:36:13 -0700
Subject: [PATCH 2/2] Update coverity-ss-action.yml

---
 .github/workflows/coverity-ss-action.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/coverity-ss-action.yml b/.github/workflows/coverity-ss-action.yml
index 2a3b8ba5..a65161c2 100644
--- a/.github/workflows/coverity-ss-action.yml
+++ b/.github/workflows/coverity-ss-action.yml
@@ -29,10 +29,10 @@ jobs:
         coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
         coverity_policy_view: ${{ github.event_name != 'pull_request' && 'Outstanding Issues' || '' }}
         coverity_prComment_enabled: true
-        coverity_build_command: mvn -B -DskipTests package
-        coverity_clean_command: mvn -B clean
+        coverity_build_command: sh -c "cd subdir && mvn -B -DskipTests package"
+        coverity_clean_command: sh -c "cd subdir && mvn -B clean"
         coverity_local: true
         coverity_install_directory: /opt/coverity/analysis/2025.12.1
         github_token: ${{ secrets.GITHUB_TOKEN }}
         include_diagnostics: true
-        project_directory: subdir
+        #project_directory: subdir