I have a Java program and it uses user.home system property to get user home directory.
This program should not allow user.home property on command line. If user pass wrong directory from command line for user.home (java -Duser.home) then my program will have security hole.
So how can I restrict user.home from command line and it should uses only through program?
It is not possible to guarantee that
user.homeis set correctly.user.homeis initialized from the$HOMEenvironment variable if it isn’t passed directly to the JVM.It isn’t possible to prevent a user from modifying their own environment.