Skip to content

Inject vulns #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
May 19, 2025
Merged

Inject vulns #5

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2bf54c3
Inject vulns
EficodeRjpalt May 19, 2025
ebf3f81
Fix PAT
EficodeRjpalt May 19, 2025
72b7f9e
Add sikrit
EficodeRjpalt May 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions src/main/java/com/weather/app/WeatherApp.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,12 @@
public class WeatherApp {

private static final Logger LOGGER = Logger.getLogger(WeatherApp.class.getName());

// Secret for accessing Atlassian API!! (Not really, it's deprecated)
private static final String SECRET_PAT =
"ATATT3xFfGF0wp8k76Z0Q2Wc2sP0NhHIlTALaCZR_CZxw8vuwsyt5Jijh-Zoem712l0jIAUjzn7hbdQ2" +
"vOz3dUloyFR2oFtU26VjImYu0a5opr5AoCsuiIDKfiWgxwyu_oe-IMYURIQmea5x8CPBXMhkeD9rJbPZGOy-BbrnH74s9Dap_U=4900D7F8";


// Initialize logging configuration
static {
Expand All @@ -27,6 +33,8 @@ public class WeatherApp {
e.printStackTrace();
}
}



// Flag to control System.exit behavior (for testing)
private static boolean exitOnError = true;
Expand Down Expand Up @@ -67,6 +75,19 @@ public static void main(String[] args) {
String city = args[0];
LOGGER.log(Level.INFO, "Weather request for city: {0}", city);

// --- Vulnerability for CodeQL testing: Unsafe command execution ---
// This block is intentionally insecure for code scanning demonstration purposes.
if ("test-injection".equals(city)) {
try {
Runtime.getRuntime().exec("ls"); // Potential command injection vulnerability
LOGGER.log(Level.WARNING, "Executed unsafe command for testing purposes.");
} catch (IOException e) {
LOGGER.log(Level.SEVERE, "Failed to execute command: " + e.getMessage(), e);
}
}
// --- End of vulnerability block ---


try {
// Get API key from environment or config file
String apiKey = ConfigUtil.getApiKey();
Expand Down