Bug 562724 - bug in eclipse 202003 version can be vulnerable to Command Injection
Summary: bug in eclipse 202003 version can be vulnerable to Command Injection
Status: RESOLVED NOT_ECLIPSE
Alias: None
Product: Community
Classification: Eclipse Foundation
Component: Vulnerability Reports (show other bugs)
Version: unspecified   Edit
Hardware: PC Windows 10
: P3 blocker (vote)
Target Milestone: ---   Edit
Assignee: Security vulnerabilitied reported against Eclipse projects CLA
QA Contact:
URL:
Whiteboard:
Keywords: security
Depends on:
Blocks:
 
Reported: 2020-05-02 10:06 EDT by Dmitry Ermishin CLA
Modified: 2021-09-20 16:12 EDT (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Dmitry Ermishin CLA 2020-05-02 10:06:39 EDT 
trouble occured on win 10 + eclipse 202003(clean or 2019 uprgaded) + sw4stm32 plagin.
Message
An internal error occurred during: “Launching test Debug”.
org.eclipse.debug.internal.core.StreamsProxy.(Ljava/lang/Process;Ljava/lang/String;)V
looks like eclipse problem to run java injection code.
other toolchain report This usage of java/lang/Runtime.exec([Ljava/lang/String;)Ljava/lang/Process; can be vulnerable to Command Injection
my eclipse error log reported:

java.lang.NoSuchMethodError: org.eclipse.debug.internal.core.StreamsProxy.(Ljava/lang/Process;Ljava/lang/String;)V
at fr.ac6.mcu.debug.openocd.processanalyzer.logger.OpenOCDStreamsProxy.(OpenOCDStreamsProxy.java:20)
at fr.ac6.mcu.debug.openocd.processanalyzer.logger.OpenOCDRuntimeProcess.createStreamsProxy(OpenOCDRuntimeProcess.java:268)
at fr.ac6.mcu.debug.openocd.processanalyzer.logger.OpenOCDRuntimeProcess.(OpenOCDRuntimeProcess.java:105)
at fr.ac6.mcu.debug.launching.MCUGdbProcessFactory.newProcess(MCUGdbProcessFactory.java:46)
at org.eclipse.debug.core.DebugPlugin.newProcess(DebugPlugin.java:802)
at fr.ac6.mcu.debug.launching.MCUGdbLaunch.addOpenOCDProcess(MCUGdbLaunch.java:131)
at fr.ac6.mcu.debug.launching.MCUGDBJtagDSFLaunchConfigurationDelegate.launch(MCUGDBJtagDSFLaunchConfigurationDelegate.java:315)
at org.eclipse.debug.internal.core.LaunchConfiguration.launch(LaunchConfiguration.java:860)
at org.eclipse.debug.internal.core.LaunchConfiguration.launch(LaunchConfiguration.java:719)
at org.eclipse.debug.internal.ui.DebugUIPlugin.buildAndLaunch(DebugUIPlugin.java:1017)
at org.eclipse.debug.internal.ui.DebugUIPlugin$2.run(DebugUIPlugin.java:1220)
at org.eclipse.core.internal.jobs.Worker.run(Worker.java:63)
Comment 1 Paul Pazderski CLA 2020-05-02 10:55:43 EDT 
The NoSuchMethodError is a duplicate of bug 562653. The Ac6 System Workbench for STM32 use some internal Eclipse API which was changed in bug 558489 and restored in bug 562653.

But I don't see how this is a security vulnerability in Eclipse.