proof of concept processbuilder wrapper for Java that handles .bat and .ps1 - s5bug/wprocess

An in-depth look at using the ProcessBuilder API to manipulate OS processes

ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.

Java’s ProcessBuilder and Runtime classes offer powerful functionality, but they also come with risks.

Learn how to execute and monitor Shell scripts efficiently with sudo support, working directories, and full logging control.

Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the redirect parameter to instantiate ProcessBuilder objects and execute system commands …

As of December 31st, Salesforce customers will no longer be able to create new Workflow Rules or use Process Builder in Salesforce.

A while ago I wrote the following Java 8 code on Win 10 to create an index file for a .laz file: Process p = null; ArrayList lines = new ArrayList(); String lasbinpath = "somepath\\LAStools\\bin"; String command = "lasindex64 -i someotherpath\\myfile.laz"; try { ProcessBuilder builder = new ProcessBuilder("cmd.exe", "/c", command); Map env = builder.environment(); env.put("path", lasbinpath); builder.redirectErrorStream(true); p = builder.start(); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while(true) { line = br.readLine(); if (line==null) { break; } lines.add(line); } br.close(); } catch(IOException e) { e.printStackTrace(); } finally { if(p!=null) { p.destroy(); } } Recently I got a new Win 11 PC, installed the latest LAStools version (241017), the same Eclipse version (2020-06) and Java 8 on it and copied the old project. Yesterday I ran it once and it was working fine. Then I installed Miniconda but now it always returns an error: The "DOSKEY" command is either misspelled or could not be found. done with 'someotherpath\myfile.laz'. took 0.006 sec. It does create a .lax file (can't check if it's done correctly atm) but I've never seen this error before and definitely want to fix it. What I've already tried/checked: * Cleaned the project * Restarted Eclipse and my PC * The PATH (environmental variable) looks fine imo, only the "condabin" folder was added to it * The "doskey.exe" file exists in the "system32" folder * env.get("path") is null before I set it and it's got the correct path afterwards * When I copy this path into file explorer, it does lead to the "bin" folder, so the path is definitely correct. * The lasinfo64 command opens the lasinfo window but doesn't display anything (not sure what it should look like, as I've never used it before) and the same error is printed * Java is working fine otherwise and e.g. java -version prints the java version without any errors * I tested the same code in Eclipse 2025-09 with OpenSDK 24 and it's printing the same error * I added the path to PATH (system, not user) but it's still printing the same error The weird thing is, if I call it directly from cmd like this: cd someotherpath set path=C:\Sonstiges\RestBuero\LfU\LAZ\LAStools\bin;%path% lasindex64 -i myfile.laz ...then it works - no error. With the path added to PATH, I can omit the second line and it's still working (of course). What am I missing? Did Win 11 change how Eclipse can access the environmental variables? Is there anything I have to do/add to make it use LAStools correctly? Is this version of LAStools possibly bugged in a way?

Originally published in Level Up Coding. You can read the original version here . Recently at IBM Software Labs, I worked on a task that forced me to understand something many Java developers rarely...