Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8282008

Incorrect handling of quoted arguments in ProcessBuilder

    XMLWordPrintable

Details

    • b19
    • x86_64
    • windows_10
    • Verified

    Backports

      Description

        For example, it's needed to execute the following command on Windows:
        C:\Windows\SysWOW64\WScript.exe "MyVB.vbs" "C:\Program Files\Git\" "Test"
        it's equal to:
        new ProcessBuilder("C:\\Windows\\SysWOW64\\WScript.exe", "MyVB.vbs", "\"C:\\Program Files\\Git\\\"", "Test").start();

        But the result of processing "\"C:\\Program Files\\Git\\\"" is
        1) "C:\Program" and "Files\Git\" if jdk.lang.Process.allowAmbiguousCommands = true;
        2) "\C:\Program" and "Files\Git\\\" if jdk.lang.Process.allowAmbiguousCommands = false.

        The behavior was changed with JDK-8250568, CVE-2021-2161 (Bug 1951231 (CVE-2021-2161) - CVE-2021-2161 OpenJDK: Incorrect handling of partially quoted arguments in ProcessBuilder on Windows (Libraries, 8250568), https://bugzilla.redhat.com/show_bug.cgi?id=1951231 ).
        During this security fix the restriction to the string ending with "\\\"" was added so now such a string is treated as unquoted even it begins with a quote.

        Attachments

          1. Main.java
            0.4 kB
          2. MyVB.vbs
            0.3 kB

          Issue Links

            backported by

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8286626 Incorrect handling of quoted arguments in ProcessBuilder

            • P3 - Major loss of function.
            • Resolved

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8286806 Incorrect handling of quoted arguments in ProcessBuilder

            • P3 - Major loss of function.
            • Resolved

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8293057 Incorrect handling of quoted arguments in ProcessBuilder

            • P3 - Major loss of function.
            • Resolved

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8293058 Incorrect handling of quoted arguments in ProcessBuilder

            • P3 - Major loss of function.
            • Resolved

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8293059 Incorrect handling of quoted arguments in ProcessBuilder

            • P3 - Major loss of function.
            • Resolved
            csr for

            CSR - null JDK-8282989 Incorrect handling of quoted arguments in ProcessBuilder on Windows

            • P2 - Crashes, loss of data, severe memory leak.
            • Closed
            relates to

            Bug - A problem which impairs or prevents the functions of the product. JDK-8285734 Unexpected Quotes in ProcessBuilder launched App

            • P3 - Major loss of function.
            • Open
            links to

            Commit Commit openjdk/jdk11u-dev/c9d3291e

            Commit Commit openjdk/jdk17u-dev/b6404c83

            Commit Commit openjdk/jdk/897d6c0d

            Review Review openjdk/jdk11u-dev/1040

            Review Review openjdk/jdk17u-dev/386

            Review Review openjdk/jdk/7504

            Review Review openjdk/jdk/7709

            Activity

              People

                rriggs Roger Riggs
                omikhaltcova Olga Mikhaltcova
                Votes:
                1 Vote for this issue
                Watchers:
                11 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved: