Question

I am trying to access SVN through the process command in Java as part of a larger GUI to see what files are on the SVN. After much research, I have significantly refined my methods, however I still cannot accomplish it. If I run the code in the GUI, it just hangs. To discover what that problem was, I simplified it and ran it as a console program. When I ran it there, it displayed a request for my GNOME keyring. My code enters the password but the console does not seem to accept it. My code follows:

    public class SvnJavaTest{
            public static void main(String[] args){
                try {
                    String[] commands = {"svn", "ls", "https://svnserver"};
                    Process beginProcess = Runtime.getRuntime().exec(commands, null, new File("/home/users/ckorb/Desktop"));
                    BufferedReader br = new BufferedReader(new InputStreamReader(beginProcess.getInputStream()));
                    BufferedWriter write = new BufferedWriter(new OutputStreamWriter(beginProcess.getOutputStream()));
                    write.write("password");
                    write.flush(); 
                    String line=br.readLine();
                    while (line != null){
                            System.out.println(line);
                            line =br.readLine();
                    }
                    br.close();
                    write.close();
                    beginProcess.waitFor();
                } catch (IOException e1) {
                    e1.printStackTrace();
                } catch (InterruptedException ie) {
                    ie.printStackTrace();
                }
           }
    }

I don’t get any errors running this and if I type in my password manually into the console and then run it, it works because it remembers my password. I have looked and found that there are some packages that would automatically enter my keyring on login but that isn’t really an option. Thank you very much.

Answer 1

The main problem with a solution like this is that you don’t really have control over stdin and stdout. A malicious person can wrap the svn command with a shell script that makes a copy of the stdin (thereby capturing all the passwords your program transmits). While shell’s flexibility makes it great in so many ways, it is the same flexibility that you are connecting to, and you’d better be comfortable with it (and it’s consequences).

That is the real reason why it is better to use a Java API to use the client, there’s a much smaller chance of injecting code which captures sensitive data (and better error reporting).