보안약점 진단 #1

01 public void do() throws Throwable {
02     String data = "";
03     {
04         Socket socket = null;
05         BufferedReader readerBuffered = null;
06         InputStreamReader readerInputStream = null;
07         try {
08             socket = new Socket("host.example.org", 39544);
09             readerInputStream = new InputStreamReader(socket.getInputStream(), "UTF-8");
10             readerBuffered = new BufferedReader(readerInputStream);
11             data = readerBuffered.readLine();
12         } catch (IOException exceptIO) {
13             IO.logger.log(Level.WARNING, "Error with stream reading", exceptIO);
14         } finally {
15             try {
16                 if (readerBuffered != null) readerBuffered.close();
17             } catch (IOException exceptIO) {
18                 IO.logger.log(Level.WARNING, "Error closing BufferedReader", exceptIO);
19             }
20            try {
21                 if (readerInputStream != null) readerInputStream.close();
22             } catch (IOException exceptIO) {
23                 IO.logger.log(Level.WARNING, "Error closing InputStreamReader", exceptIO); 
24         }
25             try {
26                 if (socket != null) socket.close();
27             } catch (IOException exceptIO) {
28                 IO.logger.log(Level.WARNING, "Error closing Socket", exceptIO);
29             }
30         }
31     }
32 
33     String osCommand;
34     if (System.getProperty("os.name").toLowerCase().indexOf("win") >= 0) {
35         osCommand = "c:\\WINDOWS\\SYSTEM32\\cmd.exe /c dir ";
36     } else {
37         osCommand = "/bin/ls ";
38     }
39     Process process = Runtime.getRuntime().exec(osCommand + data);
40     process.waitFor();
41 }