Validation Required issue by IBM AppScan

Question

IBM AppScan has thrown the error Validation Required while scanning my app for the following code:-

return Arrays.asList(System.getenv("PATH").split(":"));

I am not sure why the error is thrown. Could it be a false positive ? Can I use

System.getProperty("java.class.path")

Answer 1

AppScan is reporting validation issue as you are getting variable value from the source which is outside the app. According to IBM AppScan rules, all the strings values from outside the apps should be validated. If you are sure that nobody will change PATH value, you can say it is a false positive.

Answer 2

Split function: Depends upon what data you have to pass in function. If data is validated before passing the function then you can mark this issues as false positive. Usually we mark split function as false positive