Summary

The java.lang.Runtime.exec methods taking a single string as a command line are deprecated. The corresponding methods that take an array of strings should be used instead.

Problem

The three java.lang.Runtime.exec methods that tokenize a command line to produce an array of string arguments are easily misused, sometimes with erroneous results. For example, on some operating systems, spaces are supported in filenames and are in common use.

The tokenization uses only whitespace characters, ignoring quote characters. It is error prone because quotes may appear in the string but are ignored. The implementation (on Windows) includes a heuristic for the executable argument that tries to re-parse the command line respecting quotes but it is undocumented.

Solution

Deprecate the three methods and recommend using the corresponding Runtime.exec(String[] cmdarray), Runtime.exec(String[] cmdarray, String[] envp), Runtime.exec(String[] cmdarray, String[] envp, File dir) methods or java.lang.ProcessBuilder.

Specification

     * ...
     * @deprecated This method is error-prone and should not be used, the corresponding method
     * {@link #exec(String[])} or {@link ProcessBuilder} should be used instead.
     * The command string is broken into tokens using only whitespace characters.
     * For an argument with an embedded space, such as a filename, this can cause problems
     * as the token does not include the full filename.
     * ...

    @Deprecated(since="18")
    public Process exec(String command) throws IOException {...}

     *...
     * @deprecated This method is error-prone and should not be used, the corresponding method
     * {@link #exec(String[], String[])} or {@link ProcessBuilder} should be used instead.
     * The command string is broken into tokens using only whitespace characters.
     * For an argument with an embedded space, such as a filename, this can cause problems
     * as the token does not include the full filename.
     *...

    @Deprecated(since="18")
    public Process exec(String command, String[] envp) throws IOException {...}

     *...
     * @deprecated This method is error-prone and should not be used, the corresponding method
     * {@link #exec(String[], String[], File)} or {@link ProcessBuilder} should be used instead.
     * The command string is broken into tokens using only whitespace characters.
     * For an argument with an embedded space, such as a filename, this can cause problems
     * as the token does not include the full filename.
     *...

    @Deprecated(since="18")
    public Process exec(String command, String[] envp, File dir) {...}