Inject vulns

[EficodeRjpalt]

No description provided.

[Copilot]

Pull Request Overview

This pull request introduces intentional vulnerabilities for testing purposes, including an embedded secret and an insecure code block for command execution triggered by a specific input.

• Added a hard-coded secret for Atlassian API access.
• Introduced an intentionally insecure command execution block for CodeQL demonstrations.

Comments suppressed due to low confidence (2)

src/main/java/com/weather/app/WeatherApp.java:17

• Hard-coding secrets, even if marked as deprecated, poses a security risk. Consider loading the secret from a secure configuration or environment variable to minimize exposure.

private static final String SECRET_PAT =

src/main/java/com/weather/app/WeatherApp.java:82

• The command execution block is intentionally insecure for demonstration. Please ensure that this vulnerable code is guarded and not inadvertently enabled in production environments.

Runtime.getRuntime().exec("ls"); // Potential command injection vulnerability