From 7d44b6501328e2735ac7216e04fd1897f6e95790 Mon Sep 17 00:00:00 2001
From: Chuck Aude <21095583+chuckaude@users.noreply.github.com>
Date: Wed, 22 Apr 2026 15:28:51 -0700
Subject: [PATCH 1/2] add CommandInjection.java

---
 src/main/java/CommandInjection.java | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 src/main/java/CommandInjection.java

diff --git a/src/main/java/CommandInjection.java b/src/main/java/CommandInjection.java
new file mode 100644
index 00000000..71cec828
--- /dev/null
+++ b/src/main/java/CommandInjection.java
@@ -0,0 +1,13 @@
+// https://documentation.blackduck.com/bundle/coverity-docs/page/checker-ref/checkers/NO/os_cmd_injection.html
+
+import java.io.*;
+import javax.servlet.http.HttpServletRequest;
+
+public class CommandInjection {
+    public static Process runCmd(HttpServletRequest request) throws IOException {
+        String command = request.getParameter("command");
+        ProcessBuilder builder = new ProcessBuilder("sh", command);
+        Process process = builder.start();
+        return(process);
+    }
+}

From 291aea0c7587320d714bb982a92dd67a4b53a24d Mon Sep 17 00:00:00 2001
From: Chuck Aude <21095583+chuckaude@users.noreply.github.com>
Date: Wed, 22 Apr 2026 15:29:28 -0700
Subject: [PATCH 2/2] Update log4j-core version to 2.15.0

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 1311fa22..fd063438 100644
--- a/pom.xml
+++ b/pom.xml
@@ -25,7 +25,7 @@
     <dependency>
       <groupId>org.apache.logging.log4j</groupId>
       <artifactId>log4j-core</artifactId>
-      <version>2.14.1</version>
+      <version>2.15.0</version>
     </dependency>
   </dependencies>