title: Avoid Remote command OS Injection in Java Web Application
body: <p>We are running ZAP tool from OWSAP to check the security vulnerabilities in our application. The ZAP tool reported many Issues like Path traversal, Cross site scripting, OS command Injection. Here I did not understand what is exactly happening when OS command is executed in our application.
  The below is an example from our project which is reported while uploading file.</p>
  
  <pre><code>http://&lt;&lt;IpAddr&gt;&gt;:&lt;&lt;port&gt;&gt;/filedsMgr/upload/fileupload?/?fileSize=837259
  %7Ctimeout+%2FT+%7B0%7D
  </code></pre>
  
  <p>In the above url the attack is performed on the "filesize" parameter and the attack is "837259|timeout /T {0}".
  As per the description given by OWSAP, I understood that this is timeout command performed by ZAP tool, but I did not understand, how it is related to My application.</p>
  
  <p>Could any please tell me what is exactly it is and how to prevent this attack?</p>