title: Fortify issue - Command Injection
body: <p>I am trying to do hp fortify security scan for my java application. I have few issues and i have fixed it. But i am unable to find the fix for the below issue.</p>
  
  <ol>
  <li><p><strong>Command Injection</strong></p>
  
  <pre><code>String hostname = execReadToString("hostname").split("\\.")[0];
  public static String execReadToString(String execCommand) throws IOException {
   try (Scanner s = new Scanner(Runtime.getRuntime().exec(execCommand).getInputStream()).useDelimiter("\\A")) {
      return s.hasNext() ? s.next() : "";
  }
  </code></pre>
  
  <p>The method execReadToString() calls exec() to execute a command. This call might allow an attacker to inject malicious commands.</p></li>
  </ol>
  
  <p>So i have tried with process builder also. </p>
  
  <pre><code>private static void gethostname(String cmd1) throws IOException {
          if(Pattern.matches("[A-Za-z]+", cmd1)) {
          ProcessBuilder pb = new ProcessBuilder(cmd1);
          Process p = pb.start();
              BufferedReader reader = new BufferedReader(new InputStreamReader(
                      p.getInputStream()));
              String readline;
              while ((readline = reader.readLine()) != null) {
                  System.out.println(readline);
              }
          }
      }
  </code></pre>
  
  <p>Even this is giving me an security issue <strong>This start() call might allow an attacker to inject malicious commands.</strong></p>
  
  <p>What will be the ideal fix for this issue?</p>
  
  <p>Thanks in advance</p>