Execute shell script from PEGA
Hello ,
My requirement is to execute a shell script from PEGA 8.3.
I tried the below code and it is throwing vulnerable code detected error (Please see the SS). In order to resolve this I created a new DSS as mentioned in help article https://community.pega.com/sites/default/files/help_v83/procomhelpmain.htm#security/rule-security/configuring-java-injection-check-tsk.htm, but it did not seem to work.
Code tried:
try{ new ProcessBuilder("/apps/Myshellscript.sh").start(); } catch(java.io.IOException ioEx) { throw new PRRuntimeException(ioEx); }
***Edited by Moderator: Pallavi to update support request details***
Accepted Solution
Updated: 7 Sep 2021 15:58 EDT
Pegasystems Inc.
US
As per https://community.pega.com/sites/default/files/help_v83/procomhelpmain.htm#security/rule-security/configuring-java-injection-check-tsk.htm By default, Pega Platform reports errors at design time and run time, and does not run any activity, function, or stream rule that was created in Pega Platform 8.3 or later which includes any of the following: Runtime.getRuntime() new ProcessBuilder() JavaCompiler org.dita.dost.invoker. If the rule is created in a version prior to 8.3, the behavior of the upgraded/imported rule in the 8.3+ system depends upon the value of the dynamic system setting security/enableJavaInjectionMitigation as defined in the article above.
Pegasystems Inc.
US
Hi Vinay,
At this point, I think it is best that you open up a support case so that this can be looked into further. Once you do that, please reply here with the case id: INC-XXXXXX
Accepted Solution
Updated: 7 Sep 2021 15:58 EDT
Pegasystems Inc.
US
As per https://community.pega.com/sites/default/files/help_v83/procomhelpmain.htm#security/rule-security/configuring-java-injection-check-tsk.htm By default, Pega Platform reports errors at design time and run time, and does not run any activity, function, or stream rule that was created in Pega Platform 8.3 or later which includes any of the following: Runtime.getRuntime() new ProcessBuilder() JavaCompiler org.dita.dost.invoker. If the rule is created in a version prior to 8.3, the behavior of the upgraded/imported rule in the 8.3+ system depends upon the value of the dynamic system setting security/enableJavaInjectionMitigation as defined in the article above.